Unrestricted File Upload Vulnerability in kevquirk PureBlog
CVE-2026-124635

5.1MEDIUM

Key Information:

Vendor

Kevquirk

Status
Pureblog
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124635?

A vulnerability exists in the Admin Image Upload Endpoint of kevquirk PureBlog versions up to 3.7.2, allowing attackers to perform unrestricted file uploads via the admin/upload-image.php file. This can be exploited remotely, leading to potential unauthorized access and system compromise. Users are advised to upgrade to version 3.7.3, which addresses this issue with a necessary patch. The vendor responded swiftly to this discovery, showcasing effective vulnerability management.

Affected Version(s)

PureBlog 3.7.0

PureBlog 3.7.1

PureBlog 3.7.2

References

https://vuldb.com/vuln/433065
vdb-entry
https://vuldb.com/vuln/433065/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124635
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

summmm (VulDB User)
VulDB CNA Team
.