PT-2026-28340 · Bludit · Bludit

Arkadiusz Marta · CVE-2026-25100 · Published 2026-03-27 · Updated 2026-03-27

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.18.3

Description Bludit is susceptible to Stored Cross-Site Scripting (XSS) through its image upload feature. An authenticated attacker possessing content upload permissions—like Author, Editor, or Administrator—can upload a malicious SVG file. This payload executes when a user accesses the URL of the uploaded file, and the resource is accessible without authentication.

Recommendations Update to version 3.18.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25100

Affected Products

Bludit

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25100.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-25100 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25100 · Vendor Advisory
• https://github.com/bludit/bludit · Note
• https://github.com/bludit/bludit/releases/tag/3.18.2 · Note
• https://twitter.com/CVEnew/status/2037513342516937001 · Twitter Post
• https://github.com · Note
• https://cert.pl/posts/2026/03/CVE-2026-25099 · Note