PT-2026-21568 · Bludit · Bludit

Ryan Chan · Publicado 2026-02-23 · Atualizado 2026-02-24 · CVE-2026-27741

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bludit version 3.16.1

Description The application lacks anti-CSRF tokens or request origin validation for administrative actions. An attacker can trick an authenticated administrator into visiting a malicious page, which silently submits crafted requests. This can lead to unauthorized plugin uninstallation via the /admin/uninstall-plugin/ endpoint or theme installation via the /admin/install-theme/ endpoint. Successful exploitation may result in loss of functionality, execution of untrusted code through malicious themes, and compromise of system integrity.

Recommendations Apply updates to address the issue in Bludit version 3.16.1.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2026-27741

Produtos afetados

Bludit

Referências · 7

• 🔥 https://github.com/bludit/bludit/issues/1577 · Exploit
• https://vulncheck.com/advisories/bludit-csrf-in-plugin-and-theme-management-endpoints · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27741 · Nota de Segurança
• https://twitter.com/CVEnew/status/2026184678584291733 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2026110331743801509 · Publicação no Twitter
• https://t.me/CVEtracker/45530 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27741 · Aviso do Fabricante