EUVD-2026-19598
GHSA-w5x8-257x-9rv5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating functionality. An authenticated attacker with page creation privileges (such as Author, Editor, or Administrator) can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be executed when a victim visits the URL of the uploaded resource. The uploaded resource itself is accessible without authentication. Critically, this vulnerability could be used to automatically create a new site administrator if the victim has enough privileges.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 3.17.2 and 3.18.0 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
AnalysisAI
Stored XSS in Bludit page creation functionality allows authenticated users with author privileges or higher to inject malicious JavaScript via the tags field, executing arbitrary code in victims' browsers when they access the affected page. Bludit versions 3.17.2 and 3.18.0 are confirmed vulnerable; the vendor did not respond with remediation details or clarify the full version range affected. This vulnerability poses moderate immediate risk (CVSS 5.1) but carries elevated concern because injected scripts could escalate privileges to administrator level if the victim has sufficient permissions, and the malicious resource is accessible without authentication.
Technical ContextAI
Bludit is a flat-file CMS written in PHP that stores content and metadata in file structures rather than databases. The vulnerability resides in improper input validation and output encoding of the tags field during page creation, allowing stored XSS per CWE-79 (Improper Neutralization of Input During Web Page Generation). The authenticated attacker context (PR:L in CVSS vector) means the attacker must have logged-in user credentials with Author, Editor, or Administrator role. When the tagged article is rendered for viewing, the injected JavaScript payload executes in the context of the victim's session, potentially allowing session hijacking, credential theft, or administrative action execution if the victim holds elevated privileges.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vendor did not respond with remediation details. Immediate mitigations include: (1) restrict page creation privileges (Author role and above) to trusted users only, enforcing principle of least privilege; (2) implement input validation and output encoding on the tags field server-side to strip or escape JavaScript payloads before storage; (3) apply Content Security Policy (CSP) headers to limit inline script execution; (4) monitor and audit page creation logs for suspicious tag content. Contact Bludit project directly via https://github.com/bludit/bludit/ for patch availability and clarification on affected version range. For detailed vulnerability information, refer to CERT-PL advisory at https://cert.pl/en/posts/2026/04/CVE-2026-4420.
Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .j
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many
Bludit v3.8.1 is affected by directory traversal. Rated critical severity (CVSS 9.1), this vulnerability is remotely exp
A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code throu
A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arb
An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator password and escalate privilege
bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages
Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin p
A code injection vulnerability in backup/plugin.php of Bludit 3.13.1 allows attackers to execute arbitrary code via a cr
An issue was found in bludit v3.13.0, unsafe implementation of the backup plugin allows attackers to upload arbitrary fi
Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. Rated medium severity
Bludit 2.3.4 allows XSS via a user name. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, n
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today