What is the CVSS score of CVE-2026-38329?

CVE-2026-38329 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Bludit CMS are affected by CVE-2026-38329?

A critical vulnerability affecting bl-plugins (CVSS 9.8) with publicly available exploit code and no vendor-released patch poses significant operational risk requiring immediate mitigation.

How to fix or mitigate CVE-2026-38329?

Within 24 hours: Identify all systems running bl-plugins with the vulnerable {key} endpoint, restrict network access via firewall rules, enable detailed endpoint logging and alerting. Within 7 days: Deploy WAF rules to block {key} endpoint access, implement strict authentication controls on the plugin, segment affected systems from critical infrastructure, document patch dependencies to assess disable feasibility. Within 30 days: Evaluate alternative plugin solutions, obtain vendor timeline for security patch release, establish persistent monitoring and detection signatures for CVE-2026-38329 exploitation attempts.

Bludit CMS CVE-2026-38329

EUVD-2026-36757 CRITICAL

Missing Authorization (CWE-862)

2026-06-15 mitre

GHSA-9r27-c92g-8g7q

Authentication Bypass PHP RCE N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Description requires a valid API token, so PR:L not PR:N; network-reachable endpoint with no user interaction and full host compromise via PHP execution justifies AC:L and C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:29 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.

AnalysisAI

{key} endpoint in bl-plugins/api/plugin.php. Publicly available exploit code exists as a gist, though EPSS rates exploitation probability at only 0.21% (11th percentile).

Technical ContextAI

Bludit is a flat-file PHP-based content management system that does not rely on a database. The vulnerable code lives in the API plugin (bl-plugins/api/plugin.php), which exposes a REST-style file upload endpoint at POST /api/files/{key}. The root cause is classified as CWE-862 (Missing Authorization): the endpoint accepts an API token but does not enforce role-based authorization to upload, and additionally fails to allow-list permitted file extensions. Because Bludit deploys as PHP under a standard web server, any .php file written into a web-accessible directory will be interpreted and executed by the PHP handler, turning an arbitrary file write into direct code execution.

RemediationAI

Upgrade Bludit to version 3.18.4 or later, which the description identifies as the first fixed release containing the authorization check and file-extension validation in bl-plugins/api/plugin.php. For deployments that cannot upgrade immediately, disable the API plugin from the Bludit admin (Settings → Plugins → API), which removes the vulnerable endpoint entirely at the cost of breaking any legitimate API integrations. If the API plugin must remain enabled, rotate all existing API tokens, restrict /api/files/* at the reverse proxy or web server (for example via an nginx location block returning 403, or an Apache <Location> deny rule) to known administrative IPs, and confirm that the web root denies execution of newly written .php files in upload directories - note that the last control may break themes or plugins that legitimately drop PHP into bl-content. Track the upstream project at https://nvd.nist.gov/vuln/detail/CVE-2026-38329 for the official advisory link.