PT-2025-51945 · Bludit · Bludit+1

Antonio Cuomo · Published 2025-12-17 · Updated 2025-12-20 · CVE-2023-53907

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.13.1

Description A file download issue exists in the Backup Plugin within Bludit. Logged-in users can access arbitrary files. Attackers can exploit the plugin’s download functionality by manipulating file path parameters, potentially leading to the reading of sensitive system files through directory traversal.

Recommendations Update to version 3.13.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-53907

Affected Products

Db Backup Plugin

Bludit

References · 6

• 🔥 https://exploit-db.com/exploits/51541 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53907 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53907 · Vendor Advisory
• https://bludit.com · Note
• https://vulncheck.com/advisories/bludit-authenticated-arbitrary-file-download-via-backup-plugin · Note
• https://twitter.com/CVEnew/status/2002487798188945791 · Twitter Post