PatchTheCVEcnblogs vulnerabilities
Recent CVEs affecting cnblogs products. 2 tracked.
cnblogs has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-11-17. Highest priority: CVE-2025-63917 (score 39/100).
- CVE-2025-63918 MEDIUM 6.2 UPGRADE PDFPatcher executable does not validate user-supplied file paths, allowing directory traversal attacks allowin
- CVE-2025-63917 HIGH 7.1 UPGRADE PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entit
FAQ
How do I fix cnblogs vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cnblogs being exploited right now?
None of the tracked cnblogs CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cnblogs CVE should I patch first?
CVE-2025-63917 currently ranks highest (39/100): PDFPatcher thru 1.1.3.4663 executable's XML bookmark import functionality does not restrict XML external entit.