Executive brief
Bludit CMS, a popular content management system, contains a security flaw in its API plugin that allows unauthorized users to upload files. By exploiting this, an attacker can upload a malicious script to the server and take full control of the website. This could lead to the theft of sensitive data, website defacement, or a complete service outage.
Technical details
A Remote Code Execution (RCE) vulnerability exists in Bludit CMS versions prior to 3.18.4 within the API Plugin (bl-plugins/api/plugin.php). The vulnerability stems from two primary issues: a missing permission check (CWE-862) on the POST /api/files/{key} endpoint and a lack of file upload filtering (CWE-434). While other API endpoints verify write permissions, the file upload handler fails to do so, allowing any user with a valid API token (even read-only) to interact with it. Furthermore, the uploadFile() function does not validate file extensions or sanitize filenames, allowing an attacker to upload a .php file. Once uploaded, the script can be accessed directly via the web server to execute arbitrary commands. The issue is resolved in version 3.18.4.
Affected products
- Bludit Bludit CMS < 3.18.4
Timeline
- 2026-06-11: disclosed: Vulnerability details shared via GitHub Gist.
- 2026-06-15: advisory: CVE-2026-38329 published.