EUVD-2026-55230
GHSA-jvgc-4pc6-8x5f
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Author-role authentication (PR:L) and victim page load (UI:R) required; S:C reflects script executing in arbitrary victim browser sessions outside the CMS component.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload endpoint in bl-kernel/ajax/logo-upload.php moves the uploaded file directly to the web root via Filesystem::mv() without invoking sanitizeSVG() or transformImage(), while SVG is present in the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists. A stored script tag in the SVG executes in the browser of any user who loads the logo.
AnalysisAI
Stored XSS in Bludit 4.0.0-beta allows an authenticated Author-role user to plant persistent JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload.php endpoint accepts SVG files permitted by ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES but moves them directly to the web root via Filesystem::mv() without invoking the available sanitizeSVG() or transformImage() routines, leaving embedded script payloads fully intact and serving them to every subsequent site visitor. No CISA KEV listing or public exploit code was identified at time of analysis; however, the scope-change characteristic (S:C) and persistent delivery to all site visitors - including administrators - amplify practical impact beyond the moderate CVSS 5.4 score.
Technical ContextAI
Bludit is a PHP flat-file CMS that requires no database backend. The vulnerable code path is the AJAX logo-upload handler at bl-kernel/ajax/logo-upload.php, which uses the internal Filesystem::mv() method to relocate the uploaded file directly into the web root. The codebase contains sanitizeSVG() and transformImage() routines specifically designed to strip dangerous content from image uploads, but neither is invoked in the logo-upload path - a code-path omission rather than a missing capability. SVG is structurally XML and can embed active content: <script> tags, javascript: URIs in href/xlink:href attributes, and event handlers such as onload and onerror. CWE-79 (Stored Cross-Site Scripting) applies because untrusted user-supplied content (the SVG payload) is persisted to storage and later rendered in victim browsers without neutralization. The CPE string cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:* carries a wildcard version component, indicating NVD has not yet bounded the affected version range beyond the reported 4.0.0-beta release.
RemediationAI
No patched release version was identified in the available intelligence data - patch availability must be verified against the upstream repository at https://github.com/bludit/bludit and the vendor site at https://www.bludit.com before deployment decisions are made. The correct code-level fix is to invoke sanitizeSVG() (already present in the Bludit codebase) within bl-kernel/ajax/logo-upload.php prior to the Filesystem::mv() call, ensuring SVG payloads are stripped before storage. As an equally effective but functionally limiting workaround, administrators can remove 'svg' from the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES configuration arrays, blocking all SVG logo uploads at the cost of losing SVG logo support. As an immediate compensating control, administrators should audit and restrict Author-role assignments to fully trusted users only, since the attack requires an authenticated Author account - removing untrusted Author accounts eliminates the attack surface entirely. Web server-level controls (e.g., returning HTTP 403 for POST requests to /admin/ajax/logo-upload with SVG content-type) provide additional layered defense with no side effects for non-SVG logo uploads.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today