CVE-2019-9845: Miniblog.core Project Miniblog.core

Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days.

madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in Controllers/BlogController.cs writes a decoded base64 string to a file without validating the extension.

Affected products

• Miniblog.core Project Miniblog.core: up to and including 2019-01-16

Published 2019-04-16. Last modified 2026-06-17.