PT-2026-28340 · Bludit · Bludit

Arkadiusz Marta · Publicado 2026-03-27 · Atualizado 2026-03-27 · CVE-2026-25100

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.18.3

Description Bludit is susceptible to Stored Cross-Site Scripting (XSS) through its image upload feature. An authenticated attacker possessing content upload permissions—like Author, Editor, or Administrator—can upload a malicious SVG file. This payload executes when a user accesses the URL of the uploaded file, and the resource is accessible without authentication.

Recommendations Update to version 3.18.3 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-25100

Produtos afetados

Bludit

Referências · 4

• https://github.com/bludit/bludit/releases/tag/3.18.2 · Nota
• https://twitter.com/CVEnew/status/2037513342516937001 · Publicação no Twitter
• https://cert.pl/posts/2026/03/CVE-2026-25099 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-25100 · Nota de Segurança