Path Traversal Vulnerability in kevquirk PureBlog Software
CVE-2026-124636

5.1MEDIUM

Key Information:

Vendor

Kevquirk

Status
Pureblog
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124636?

A vulnerability has been identified in the kevquirk PureBlog software, specifically within the Page Editor component. This issue arises from improper handling of the page slug argument in the save_page function found in the content.php file, allowing for a path traversal attack. Remote attackers can exploit this flaw to potentially access sensitive files on the server, thus compromising security. To address this issue, users are advised to upgrade to version 3.7.3, which includes the necessary patch for this vulnerability. The vendor has acted promptly and professionally to release a fix for their users.

Affected Version(s)

PureBlog 3.7.0

PureBlog 3.7.1

PureBlog 3.7.2

References

https://vuldb.com/vuln/433066
vdb-entrytechnical-description
https://vuldb.com/vuln/433066/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124636
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

summmm (VulDB User)
VulDB CNA Team
.