CVE-2026-1811 | bolo-blog bolo-solo up to 2.6.4 Filename BackupService.java importFromMarkdown File path traversal (Issue 327)

A vulnerability described as critical has been identified in bolo-blog bolo-solo up to 2.6.4. This affects the function importFromMarkdown of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component Filename Handler. Executing a manipulation of the argument File can lead to path traversal.

This vulnerability appears as CVE-2026-1811. The attack may be performed from remote. In addition, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.