CVE-2026-124635— kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload

Quick assessment

Affected

kevquirk PureBlog

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 kevquirk PureBlog 3.7.2 及以下版本中发现了一个安全漏洞。该漏洞影响组件中 admin/upload-image.php 文件内一个未知功能，具体位于管理图像上传接口。攻击者可通过远程方式利用此漏洞，实施不受限制的任意文件上传。建议将受影响组件升级至 3.7.3 版本以修复此问题。相关补丁的提交哈希为 71f5b0de2ecb2bb2934048ed40e1155c107484e3。请尽快升级受影响组件。厂商已在早期收到报告，并以高度专业的态度迅速响应，及时发布了含修复版本的受影响产品。

CVSS 4.7 · Medium Updated Nov 09, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remotely. Upgrading to version 3.7.3 is recommended to address this issue. The name of the patch is 71f5b0de2ecb2bb2934048ed40e1155c107484e3. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Source: CVE Program / CVE List V5