Skip to main content

a-blog cms EUVDEUVD-2026-76020

| CVE-2026-87727 MEDIUM
Path Traversal (CWE-22)
2026-09-11 jpcert GHSA-qv9f-qp83-98hf
Path Traversal A Blog Cms
6.9
CVSS 4.0 · Vendor: jpcert
Share

Severity by source

Vendor (jpcert) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Arbitrary file read exposes any file the web process can access (C:H); arbitrary deletion destroys data and availability (I:H/A:H); no auth required (PR:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jpcert).

CVSS VectorVendor: jpcert

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
Sep 11, 2026 - 09:22 NVD
6.5 (MEDIUM) 6.9 (MEDIUM)
Analysis Generated
Sep 11, 2026 - 09:02 vuln.today
CVE Published
Sep 11, 2026 - 08:14 cve.org
MEDIUM 6.5

DescriptionCVE.org

a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product.

AnalysisAI

Path traversal in a-blog cms Ver. 3.2.33 and earlier enables unauthenticated remote attackers to read or delete arbitrary files on the server filesystem. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions - remote unauthenticated exploitation against default configurations of a-blog cms Ver. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-reported CVSS 3.0 score of 6.5 (C:L/I:L/A:N) materially understates real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to a-blog cms Ver. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in A Blog Cms

View all
CVE-2022-21142 CRITICAL
9.8 Feb 24

Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versio
CVE-2024-23348 HIGH
8.8 Jan 23

Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series ver
CVE-2024-23180 HIGH
8.8 Jan 23

Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series ver
CVE-2024-23182 HIGH
8.1 Jan 23

Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versi
CVE-2025-31103 HIGH
7.5 Mar 31

Untrusted data deserialization vulnerability exists in a-blog cms. Rated high severity (CVSS 7.5), this vulnerability is
CVE-2024-31396 MEDIUM
6.6 May 22

Code injection vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12 and Ver.3.0.x series ver
CVE-2016-1178 MEDIUM
6.5 Apr 12

The session management of the comment functionality in appleple a-blog cms 2.6.0.1 and earlier allows remote attackers t
CVE-2024-31394 MEDIUM
6.5 May 22

Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series v
CVE-2024-27279 MEDIUM
6.5 Mar 12

Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.
CVE-2022-23810 MEDIUM
6.5 Feb 24

Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms V
CVE-2016-1179 MEDIUM
6.1 Apr 12

Cross-site scripting (XSS) vulnerability in the standard template of the comment functionality in appleple a-blog cms 2.
CVE-2024-31395 MEDIUM
6.1 May 22

Cross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.12, Ver.3.0.x series

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Share

EUVD-2026-76020 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy