Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited, a remote authenticated attacker with the administrator privilege may obtain or delete any file on the server.

Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited, a remote authenticated attacker with the administrator privilege may obtain or delete any file on the server.

a-blog cms provided by appleple inc. contains multiple vulnerabilities listed below. <ul> <li>Path traversal (CWE-22)</li> <ul> <li>CVE-2025-27566</li> <li>This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege</li> </ul> <li>Cross-site scripting (CWE-79)</li> <ul> <li>CVE-2025-32999</li> <li>This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges</li> </ul> <li>Server-side request forgery (CWE-918)</li> <ul><li>CVE-2025-36560</li></ul> <li>Improper output neutralization for logs (CWE-117)</li> <ul><li>CVE-2025-41429</li></ul> CVE-2025-27566, CVE-2025-32999 haidv35 (Dinh Viet Hai) reported these vulnerabilities to the developer and coordinated. After the coordination was completed, haidv35 (Dinh Viet Hai) reported the case to JPCERT/CC to notify users of the solution through JVN. CVE-2025-36560, CVE-2025-41429 vcth4nh from VCSLab of Viettel Cyber Security (Vu Chi Thanh) reported these vulnerabilities to JPCERT/CC. JPCERT/CC coordinated with the developer.