CVE-2026-1813CWE-284CWE-434

bolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted upload

Medium · published February 3, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

A vulnerability was found in bolo-blog bolo-solo up to 2.6.4. Affected is an unknown function of the file src/main/java/org/b3log/solo/bolo/pic/PicUploadProcessor.java of the component FreeMarker Template Handler. The manipulation of the argument File results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00375 · 30.3th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-02-03T23:32Z
EPSS history
Timeline
  • 03 FEB 23:32Z
    bolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted upload
    cvelistv5