a-blog CMS Path Traversal CVE-2026-87727

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: JVN#20829034 — Path Traversal vulnerability in the file attachment feature of a-blog cms forms CVE ID: CVE-2026-87727 Vulnerability Description: An attacker can send a crafted request to the form confirmation page, triggering the unauthorized reading, copying, moving, or deleting of files on the server side. Scope of Impact Affected Versions: - a-blog cms Ver. 3.2.33 and earlier (Ver. 3.2.x series) - a-blog cms Ver. 3.1.76 and earlier (Ver. 3.1.x series) - a-blog cms Ver. 3.0.63 and earlier (Ver. 3.0.x series) - a-blog cms Ver. 2.1.1 and earlier (Ver. 2.1.x series) Impact: - Configuration files may be read, potentially leaking sensitive information such as database connection details and external service connection details - Files on the server (configuration files, logs, uploaded files, backup files, etc.) may be read - The information read can be used for improper access to the database or administrative interface - Copying or deleting files may cause the website to fail to display - Server configuration or settings may be compromised, leading to abnormal behavior Remediation 1. Temporary Mitigation: In the "Form Edit Screen" of the administration page, disable the file attachment feature within the "Visible to Administrator" setting. 2. Version Upgrade: Upgrade to the fixed versions: - Ver. 3.2.33 or later (3.2.x series) - Ver. 3.1.76 or later (3.1.x series) - Ver. 3.0.63 or later (3.0.x series) - For versions prior to Ver. 2.1.1, the fixed version is available only after the provision period for security fixes has ended via the Meta service 3. Other: For versions prior to Ver. 2.1.1, a separate corrective patch can be provided; contact the vendor for details. POC / Exploit Code The page does not contain POC code or an exploit code block.

Goal Reached Thanks to every supporter — we hit 100%!

a-blog CMS Path Traversal CVE-2026-87727