Threats affecting pkg:github/kevquirk/pureblog

CVE-2026-124636 is a path traversal vulnerability in kevquirk PureBlog versions 3.7.0 through 3.7.2. The flaw exists in the save_page function within includes/lib/content.php of the Page Editor component. An attacker can manipulate the page slug argument to perform path traversal, potentially accessing unauthorized files. Remote exploitation is possible. The issue is fixed in version 3.7.3.

CVE-2026-124635 is a vulnerability in kevquirk PureBlog versions 3.7.0 through 3.7.2 affecting the admin/upload-image.php component. It allows remote attackers to perform unrestricted file uploads. The issue is resolved in version 3.7.3, which should be applied to mitigate the risk.