EUVD-2026-36757
GHSA-9r27-c92g-8g7q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires a valid API token, so PR:L; otherwise network exploitable with low complexity and no user interaction.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.
AnalysisAI
Remote code execution in Bludit CMS before 3.18.4 allows attackers with a valid API token to upload a malicious PHP script via the API plugin's /api/files/{key} endpoint. The vulnerability arises from missing authorization checks and lack of file extension validation, enabling arbitrary code execution on the server. A public proof-of-concept exists, but no active exploitation has been confirmed (not in CISA KEV) and EPSS score is low (0.21%).
Technical ContextAI
Bludit is a flat-file PHP CMS. The API plugin provides a REST API for content management, with the /api/files/{key} endpoint handling file operations. The root cause is CWE-862: Missing Authorization, meaning the code does not verify whether the requester should be allowed to upload files. Combined with absent file extension validation, a crafted PHP file can be saved in a web‑accessible directory and executed. The CPE identifier is currently a generic placeholder, but the affected product is clearly Bludit CMS.
RemediationAI
Upgrade to Bludit CMS 3.18.4 or later, where the vulnerability is reportedly fixed. If immediate upgrade is not possible, disable the API plugin entirely to remove the attack surface, or enforce strict web server access controls (e.g., blocking POST requests to /api/files/*) as a temporary measure-however, this may break legitimate API functionality. Additionally, rotate and strengthen API tokens to reduce the risk of token compromise.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today