PT-2026-28340 · Bludit · Bludit

Arkadiusz Marta · Published 2026-03-27 · Updated 2026-03-27 · CVE-2026-25100

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bludit versions prior to 3.18.3

Description Bludit is susceptible to Stored Cross-Site Scripting (XSS) through its image upload feature. An authenticated attacker possessing content upload permissions—like Author, Editor, or Administrator—can upload a malicious SVG file. This payload executes when a user accesses the URL of the uploaded file, and the resource is accessible without authentication.

Recommendations Update to version 3.18.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25100

Affected Products

Bludit

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-25100 · Security Note
• https://github.com/bludit/bludit/releases/tag/3.18.2 · Note
• https://twitter.com/CVEnew/status/2037513342516937001 · Twitter Post
• https://cert.pl/posts/2026/03/CVE-2026-25099 · Note