bolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization_CVE-2026-1691

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Description

A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component SnakeYAML. Such manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Basic Information

ID CVE-2026-1691

Source VulDB

Published Jan 30, 2026 at 17:02

Affected Product

Vendor n/a

Product bolo-solo

Version 2.6.0

Affected Versions n/a bolo-solo 2.6.0
n/a bolo-solo 2.6.1
n/a bolo-solo 2.6.2
n/a bolo-solo 2.6.3
n/a bolo-solo 2.6.4

CWE Classification

CWE-502 CWE-20

References

{
    "lastseen": "",
    "description": "A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/main/java/org/b3log/solo/bolo/prop/BackupService.java of the component SnakeYAML. Such manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
    "published": "2026-01-30T17:02:06.205Z",
    "modified": "2026-01-30T17:02:06.205Z",
    "type": "cve",
    "title": "bolo-solo SnakeYAML BackupService.java importMarkdownsSync deserialization",
    "source": "VulDB",
    "references": "https://vuldb.com/?id.343485\nhttps://vuldb.com/?ctiid.343485\nhttps://vuldb.com/?submit.741899\nhttps://github.com/bolo-blog/bolo-solo/issues/325\nhttps://github.com/bolo-blog/bolo-solo/issues/325#issue-3828755519",
    "id": "CVE-2026-1691",
    "bulletinFamily": "",
    "cwe": [
        "CWE-502",
        "CWE-20"
    ],
    "cvelist": null,
    "sourceData": "n/a bolo-solo 2.6.0\nn/a bolo-solo 2.6.1\nn/a bolo-solo 2.6.2\nn/a bolo-solo 2.6.3\nn/a bolo-solo 2.6.4",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "bolo-solo",
    "version": "2.6.0",
    "vendor": "n/a",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}