EUVD-2026-16579Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload privileges (such as Author, Editor, or Administrator) can upload an SVG file containing a malicious payload, which is executed when a victim visits the URL of the uploaded resource. The uploaded resource itself is accessible without authentication.
The vendor was notified early about this vulnerability, but stopped responding in the middle of coordination. All versions up to 3.18.2 are considered to be vulnerable, future versions might also be vulnerable.
AnalysisAI
Bludit up to version 3.18.2 allows authenticated users with content upload privileges to execute arbitrary JavaScript in victim browsers via stored XSS in SVG image uploads. An attacker with Author, Editor, or Administrator role can upload a malicious SVG file that executes when accessed by any unauthenticated visitor to the uploaded resource URL, compromising browser sessions and potentially enabling account takeover or sensitive data theft. No public exploit code has been identified at time of analysis, though the vendor was notified early and subsequently ceased coordination.
Technical ContextAI
The vulnerability exists in Bludit's image upload handling mechanism (cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:*), which fails to properly sanitize or restrict SVG file uploads. SVG files are XML-based vector graphics that can embed JavaScript via script elements or event handlers, creating a classic Stored XSS (CWE-79) condition. Unlike reflected XSS, stored XSS persists on the server and executes for all visitors accessing the malicious resource, increasing impact scope. The root cause is inadequate input validation and output encoding of uploaded content, combined with the decision to serve uploaded assets without authentication, creating a trust boundary violation where user-controlled content is treated as trusted server content.
RemediationAI
No vendor-released patch is currently available. If your organization runs Bludit, immediately restrict SVG file upload capabilities by disabling SVG in the content upload settings or implementing file type whitelisting to prevent uploads of image/* types that support embedded scripts (configure web server or application to reject SVG, PDF, or other executable-capable formats). As an interim control, configure the web server (nginx/Apache) to serve all user-uploaded assets with Content-Security-Policy headers (e.g., Content-Security-Policy: script-src 'self'; default-src 'self') and Content-Type: image/svg+xml with sandbox attribute to prevent script execution. Require authentication for access to the /uploads directory via reverse proxy or application-level controls. Monitor for unauthorized SVG uploads and review editor account access logs. Contact the Bludit project at https://cert.pl/posts/2026/03/CVE-2026-25099 to determine if patched versions are in development. Consider migration to an actively maintained CMS if Bludit remains unpatched after 30 days.
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many
Bludit v3.8.1 is affected by directory traversal. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code throu
A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arb
An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privilege
bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages
Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin p
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a cr
An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary fi
Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. Rated medium severity
Bludit 2.3.4 allows XSS via a user name. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, n
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today