PT-2026-28339 · Bludit · Bludit

Arkadiusz Marta · Publicado 2026-03-27 · Atualizado 2026-03-27 · CVE-2026-25099

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.18.4

Description The API plugin in Bludit allows a user with a valid API token to upload files of any type and extension without restriction. Successful exploitation of this issue can lead to Remote Code Execution. The API endpoint used for file upload does not properly validate the uploaded file's type or extension, allowing an attacker to upload and execute malicious files. The vulnerable parameter is the file itself, uploaded through the API.

Recommendations Update to version 3.18.4 or later.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-25099

Produtos afetados

Bludit

Referências · 4

• https://github.com/bludit/bludit/releases/tag/3.18.4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-25099 · Nota de Segurança
• https://twitter.com/CVEnew/status/2037513341187268809 · Publicação no Twitter
• https://cert.pl/posts/2026/03/CVE-2026-25099 · Nota