Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter

Who is affected

How to fix it

CVE-2026-15420 affects Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder and involves file access or path traversal. Successful exploitation may read, overwrite, or delete files outside the intended directory. Prioritize deployments that process untrusted input, expose the affected feature, or hold sensitive data. Upgrade Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder to 5.0.1 or a later vendor-supported fixed release.

1. Inventory every deployment, device, package, plugin, container, build, and environment that uses Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder.
2. Compare the installed version with the recorded affected range: <= 5.0.0, *-5.0.0.
3. Upgrade Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder to 5.0.1 or a later vendor-supported fixed release.
4. Until patched, disable the affected Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder feature or plugin and restrict its public and administrator endpoints.
5. Review configuration, roles, tokens, network paths, and exposed endpoints connected to Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder; remove access that is not required.
6. Review filesystem, application, and audit logs for parent-directory segments, absolute paths, unexpected reads, writes, or deletions outside the intended root.
7. If exploitation is suspected, isolate affected assets, preserve evidence, rotate exposed credentials or keys, restore trusted data, and rebuild compromised systems before returning them to service.

Verify the fix

• Confirm every affected asset now runs the fixed vendor-supported release or has the documented mitigation for CVE-2026-15420 in place.
• Use a safe regression test to confirm the affected file access or path traversal path no longer produces the vulnerable behavior.
• Confirm temporary access controls, endpoint restrictions, network blocks, and least-privilege settings remain effective after the update.
• Review post-remediation logs and rerun Fixnx plus the relevant package, dependency, firmware, browser, or product-specific security check.
• Document affected assets, versions, changes, validation evidence, reviewed logs, and any credential rotation, cleanup, or replacement completed.

Related categories

Related security risks

More published guidance from the same primary category.

Trusted references

FAQ