Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by bleenco

    CVE-2026-108772 (GCVE-0-2026-108772)

    Vulnerability from nvd – Published: 2026-10-11 22:30 – Updated: 2026-10-11 22:30
    VLAI
    Title
    bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal
    Summary
    A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
    5.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
    CWE
    Assigner
    VulDB CNA under the mitre root
    CNA scorecard B 82/100 over 3739 records in the last 180 days details
    References
    URL Tags
    https://vuldb.com/vuln/416553 vdb-entrytechnical-description
    https://vuldb.com/vuln/416553/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-108772 third-party-advisory
    https://vuldb.com/submit/958032 third-party-advisory
    https://glacier-tarsal-711.notion.site/abstruse-w… exploit
    Impacted products
    Vendor Product Version
    bleenco abstruse Affected: 2.0
    Affected: 2.1.0
        cpe:2.3:a:bleenco:abstruse:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Zy0t1 (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:bleenco:abstruse:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Cache Endpoint"
          ],
          "product": "abstruse",
          "vendor": "bleenco",
          "versions": [
            {
              "status": "affected",
              "version": "2.0"
            },
            {
              "status": "affected",
              "version": "2.1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Zy0t1 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T22:30:20.615Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416553 | bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416553"
        },
        {
          "name": "VDB-416553 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416553/cti"
        },
        {
          "name": "CVE-2026-108772 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108772"
        },
        {
          "name": "Submit #958032 | bleenco Abstruse v2.1.0 Authentication Bypass, Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/958032"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://glacier-tarsal-711.notion.site/abstruse-worker_cache_path_traversal-3d0b25e24b368035a445c1f09b0b34f6?source=copy_link"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-11T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-11T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-11T09:45:20.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108772",
    "datePublished": "2026-10-11T22:30:20.615Z",
    "dateReserved": "2026-10-11T07:40:15.076Z",
    "dateUpdated": "2026-10-11T22:30:20.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-108772 (GCVE-0-2026-108772)

    Vulnerability from cvelistv5 – Published: 2026-10-11 22:30 – Updated: 2026-10-11 22:30
    VLAI
    Title
    bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal
    Summary
    A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
    5.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C
    CWE
    Assigner
    VulDB CNA under the mitre root
    CNA scorecard B 82/100 over 3739 records in the last 180 days details
    References
    URL Tags
    https://vuldb.com/vuln/416553 vdb-entrytechnical-description
    https://vuldb.com/vuln/416553/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-108772 third-party-advisory
    https://vuldb.com/submit/958032 third-party-advisory
    https://glacier-tarsal-711.notion.site/abstruse-w… exploit
    Impacted products
    Vendor Product Version
    bleenco abstruse Affected: 2.0
    Affected: 2.1.0
        cpe:2.3:a:bleenco:abstruse:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Zy0t1 (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:bleenco:abstruse:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Cache Endpoint"
          ],
          "product": "abstruse",
          "vendor": "bleenco",
          "versions": [
            {
              "status": "affected",
              "version": "2.0"
            },
            {
              "status": "affected",
              "version": "2.1.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Zy0t1 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Join of the file server/api/worker/download_cache.go of the component Cache Endpoint. Such manipulation of the argument File leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T22:30:20.615Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-416553 | bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/416553"
        },
        {
          "name": "VDB-416553 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/416553/cti"
        },
        {
          "name": "CVE-2026-108772 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-108772"
        },
        {
          "name": "Submit #958032 | bleenco Abstruse v2.1.0 Authentication Bypass, Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/958032"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://glacier-tarsal-711.notion.site/abstruse-worker_cache_path_traversal-3d0b25e24b368035a445c1f09b0b34f6?source=copy_link"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-11T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-11T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-11T09:45:20.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-108772",
    "datePublished": "2026-10-11T22:30:20.615Z",
    "dateReserved": "2026-10-11T07:40:15.076Z",
    "dateUpdated": "2026-10-11T22:30:20.615Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}