CVE-2026-1812 is a medium severity path traversal flaw (CVSS 6.3) in bolo-solo, the bolo-blog Java blog platform, up to version 2.6.4. The importFromCnblogs function mishandles a file argument. A public exploit exists and the project had not responded when the CVE was filed.
What's affected
bolo-solo up to and including 2.6.4 is affected. The flaw sits in the function importFromCnblogs in BackupService.java, in the filename handler. The CVE record says the project was told early through an issue report but had not responded. No fixed version is listed, so check the project's repository for any later release.
How to check if you're exposed
Find the bolo-solo version you deploy, from the jar name, the container tag or the admin page. Anything at or below 2.6.4 matches. Then open the project's issue 328 and its releases page to see whether a fix has appeared since this was written.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in.
What to do now
- Identify every bolo-solo instance you run.
- Restrict the admin and backup import features to trusted users and networks.
- Run the application under a low privilege account with write access only to its own data directory.
- Watch the upstream issue and releases, and plan a migration if no fix arrives.
Why it matters
Path traversal, CWE-22, happens when a file name supplied by a user is used to build a path without confining it to an intended folder. The result can be reading or writing files elsewhere on the host. The CVSS vector requires a low privilege account, which narrows exposure to people who already have some access.
With a public exploit and an unresponsive project, the safe stance is to reduce who can reach the feature. The CVE is not in CISA's KEV list.
Quick check
Is there a patch?
The record lists none and says the project had not responded. Check the repository.
Is it exploited in the wild?
The record says an exploit is public. It does not say attacks were seen, and the CVE is not in KEV.
Sources
Last reviewed: 19 October 2026.
