a-blog cms vulnerable to path traversal
a-blog CMS, a Japanese blogging platform, has a flaw that lets attackers bypass its file protections and read or delete files on your server. Attackers can send specially crafted requests to trick the software into revealing private files or even deleting them.
- Severity
- MediumCVSS 3.0 · 6.5 · jpcert.or.jp
- Fix
- Not confirmedLast checked today
- Affected versions
- through 3.2.33
- Weakness
- CWE-22Path Traversal
- Exploit likelihood
- 0.28% in 30 daysEPSS, higher than 20% of known flaws
- Affects
- a-blog cms
- Exploited
- Not confirmedNo confirmation recorded
- CISA SSVC
- No known exploitationAutomatable: yes · Technical impact: partial
- EU ID
- EUVD-2026-76020ENISA vulnerability database
How it works
- An attacker sends a request with a specially crafted file path to the a-blog CMS.
- The software does not properly check if the path is valid, so it follows the attacker's path instead of the intended one.
- This lets the attacker access files outside the allowed directory, such as private configuration files or user data.
- If the attacker sends a path that points to a file meant for deletion, the software may delete it by mistake.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact Low Some data can be read
- Integrity impact Low Some data can be modified
- Availability impact None No availability impact
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Open in FIRST.org calculator