What is the CVSS score of CVE-2026-50869?

CVE-2026-50869 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Bludit are affected by CVE-2026-50869?

Bludit 3.19.0 contains a critical unauthenticated path traversal vulnerability (CVE-2026-50869) enabling remote attackers to access and modify arbitrary files on compromised servers.

How to fix or mitigate CVE-2026-50869?

Within 24 hours: Conduct inventory of all Bludit 3.19.0 deployments; implement WAF rules to block requests to api/plugin.php; restrict network access to Bludit servers to trusted sources only. Within 7 days: Enable file integrity monitoring and comprehensive access logging; review server logs for exploitation attempts; assess whether the plugin API endpoint can be disabled. Within 30 days: Monitor Bludit vendor advisories for patched version availability; plan and execute upgrade to patched release; conduct forensic analysis of affected systems for unauthorized file access or modification.

Bludit CVE-2026-50869

EUVD-2026-36767 CRITICAL

Path Traversal (CWE-22)

2026-06-15 mitre

GHSA-fx7h-q7c6-m6ch

Path Traversal PHP N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Network-reachable endpoint, no auth or interaction per description; arbitrary file read yields C:H, I/A lowered since traversal alone reads files rather than writing or crashing the service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:32 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

9.8 (CRITICAL)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.

AnalysisAI

Path traversal in Bludit 3.19.0's api/plugin.php endpoint allows remote attackers to escape the intended directory and access arbitrary files on the server via crafted requests. The CVSS 9.8 rating reflects unauthenticated network-based exploitation with high impact across confidentiality, integrity, and availability, and publicly available exploit code exists in a public gist, though EPSS remains low at 0.25%.

Technical ContextAI

Bludit is a flat-file PHP-based CMS that stores content as JSON/text rather than in a database, making filesystem operations central to its functionality. The vulnerable api/plugin.php is part of Bludit's REST API surface that exposes plugin-related operations. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) indicates the endpoint accepts user-supplied path input and concatenates or resolves it against a base directory without properly canonicalizing or rejecting '../' sequences, allowing references outside the intended plugin directory. Because Bludit runs under the webserver user with read access to its own configuration (including users.php containing credential hashes), traversal into core directories can expose authentication material.

RemediationAI

No vendor-released patch identified at time of analysis - no Bludit advisory, tagged release, or commit is referenced in the provided intelligence. Operators of Bludit 3.19.0 should monitor https://github.com/bludit/bludit/releases and https://nvd.nist.gov/vuln/detail/CVE-2026-50869 for a fixed build, and in the interim apply compensating controls: block external access to /api/plugin.php at the reverse proxy or WAF (side effect: breaks legitimate plugin-management API automation), enforce authentication and IP allow-listing on /api/* (side effect: complicates remote administration), and add a WAF rule rejecting requests containing '../', '%2e%2e%2f', or null-byte sequences against the api/ path (side effect: may false-positive on legitimate path-like parameters). If the site does not use the plugin API, removing or chmod-restricting api/plugin.php is the cleanest mitigation. Review webserver logs for past traversal patterns targeting bl-content/databases/users.php since exposure of password hashes would warrant credential rotation.