CVE-2023-41009

CVE-2023-41009 affects adlered bolo-solo v2.6: a file-upload vulnerability enables remote code execution via a crafted script placed in the Authorization header during upload. CVSS indicates CRITICAL risk (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Multiple sources (NVD, Red Hat, OSV, CVE lists) confi...

CVE-2026-1691

CVE-2026-1691 affects bolo-solo up to 2.6.4, specifically the function importMarkdownsSync in BackupService.java (SnakeYAML). The vulnerability enables deserialization via this pathway, with remote execution potential as stated. The exploit has been disclosed publicly. Connected sources provide v...

CVE-2026-1813

The CVE-2026-1813 entry concerns bolo-blog bolo-solo up to version 2.6.4, involving the FreeMarker Template Handler. It identifies an issue in the file src/main/java/org/b3log/solo/bolo/pic/PicUploadProcessor.java where manipulation of the File argument enables unrestricted upload. This could all...

CVE-2026-1810

CVE-2026-1810 affects bolo-blog/bolo-solo up to version 2.6.4 . The vulnerability resides in the ZIP File Handler, specifically the function unpackFilteredZip in src/main/java/org/b3log/solo/bolo/prop/BackupService.java, where manipulating the argument File can cause a path traversal. Exploitatio...

CVE-2026-1811

The CVE-2026-1811 entry concerns bolo-blog bolo-solo up to version 2.6.4. The vulnerability lies in the Filename Handler’s importFromMarkdown function (BackupService.java). Manipulating the File argument can trigger path traversal, with a remote attack vector. Public exploitation has been publish...

CVE-2026-1812

The CVE-2026-1812 issue affects bolo-blog/bolo-solo up to version 2.6.4. The flaw is a path traversal in the importFromCnblogs() function of BackupService.java in the Filename Handler component, caused by manipulation of the File argument. This allows remote exploitation and has had its exploit d...