CVE-2026-1813 is a medium severity unrestricted file upload flaw (CVSS 6.3) in bolo-solo, the bolo-blog Java blog platform, up to version 2.6.4. The picture upload processor accepts a file it should restrict. A public exploit exists and the project had not responded to the report.
What's affected
bolo-solo up to and including 2.6.4 is affected. The record points at PicUploadProcessor.java and the FreeMarker template handler. No fixed version is listed, and the record says the project had not responded to the issue report at filing time.
How to check if you're exposed
Work out which bolo-solo version you run. At or below 2.6.4 means affected. Check the project's issue 329 and its releases for a later fix. Also look at the upload directory for files that are not images.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads your manifests and lock files, so it will find this package if your own code pulls it in.
What to do now
- Find your bolo-solo instances and versions.
- Limit who can reach the upload feature, and put the admin area behind a network control.
- Check the upload directory for unexpected file types and review web server rules so uploads cannot run as code.
- Watch the upstream issue for a fix, and consider moving to a maintained platform if none comes.
Why it matters
The weaknesses are CWE-434, unrestricted upload of dangerous file types, and CWE-284, improper access control. When an application accepts a file without checking what it is, an attacker can place content the server later treats as code or as a template.
The record involves the FreeMarker template handler, so uploaded content reaching template processing is the risk to understand. It needs a low privilege account. The CVE is not in CISA's KEV list.
Quick check
What should I check first?
Whether anyone untrusted can reach the upload feature, then the upload folder contents.
Has the project fixed it?
The record says no response at the time. Check the repository for current status.
Sources
Last reviewed: 19 October 2026.
