high8.8Public exploit code
CVE-2026-25099
Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be ex…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Bludit CMS 3.18.4 - RCE2026-05-07 · webapps · multiple
Impact
Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bludit | Bludit | before 3.18.4 |