Full Report
CERT Polska has received a report about 3 vulnerabilities (from CVE-2026-25099 to CVE-2026-25101) found in Bludit software.
Analysis Summary
# Vulnerability: Multiple Flaws in Bludit CMS
## CVE Details
- **CVE ID:** CVE-2026-25099, CVE-2026-25100, CVE-2026-25101
- **CVSS Score:** Not explicitly provided in the source (Severity: High/Critical for RCE, Medium/High for XSS/Session Fixation)
- **CWE:**
- CWE-434: Unrestricted Upload of File with Dangerous Type
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-384: Session Fixation
## Affected Systems
- **Products:** Bludit (Flat-file CMS)
- **Versions:**
- **CVE-2026-25099:** Versions prior to 3.18.4
- **CVE-2026-25100:** All versions through 3.18.2 (and potentially future versions)
- **CVE-2026-25101:** Versions prior to 3.17.2
- **Configurations:**
- CVE-2026-25099 requires the **API plugin** to be enabled.
- CVE-2026-25100 requires an authenticated user with upload privileges (Author, Editor, or Administrator).
## Vulnerability Description
1. **CVE-2026-25099 (Remote Code Execution):** The API plugin fails to restrict file types or extensions during uploads. An authenticated attacker with a valid API token can upload and execute malicious files (e.g., PHP shells) on the server.
2. **CVE-2026-25100 (Stored XSS):** The image upload functionality allows the upload of SVG files containing JavaScript payloads. Because the uploaded resource is accessible without authentication, the script executes in the context of any user who views the direct URL of the file.
3. **CVE-2026-25101 (Session Fixation):** The application fails to rotate the session identifier upon user login. An attacker can pre-set a session ID for a victim and then hijack that session once the victim successfully authenticates.
## Exploitation
- **Status:** PoC availability implied (vulnerabilities confirmed via Coordinated Vulnerability Disclosure)
- **Complexity:** Low to Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full system access via RCE; session hijacking)
- **Integrity:** High (Modification of site content and system files)
- **Availability:** High (Potential for site takeover or deletion)
## Remediation
### Patches
- **CVE-2026-25099:** Update to Bludit **3.18.4** or later.
- **CVE-2026-25101:** Update to Bludit **3.17.2** or later.
- **CVE-2026-25100:** No official patch confirms a fix; users should update to the latest available version, but note that 3.18.2 and earlier remain vulnerable.
### Workarounds
- **Disable API:** For CVE-2026-25099, disable the API plugin if it is not strictly required.
- **File Validation:** Manually restrict or sanitize SVG uploads via web server configurations (e.g., .htaccess or Nginx rules) to prevent execution of embedded scripts.
- **Restrict Access:** Limit upload privileges to highly trusted users only.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected PHP files in the `bl-content/uploads/` directory.
- SVG files containing `<script>` tags in the uploads folder.
- API logs showing unusual file upload activity.
- **Detection Methods:**
- File integrity monitoring (FIM) on the web root.
- Security scanning of uploaded media files for embedded scripts.
## References
- **Vendor Advisory:** hxxps[://]cert[.]pl/en/posts/2026/03/cvd-bludit/
- **CVE Records:**
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-25099
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-25100
- hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-25101