# CVE-2026-38329: Bludit CMS remote code execution in API Plugin

Source: https://junglewise.ai/threats/cve-2026-38329-bludit-cms-remote-code-execution-in-api-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-38329 · Severity: info · CVSS 9.8 · Published 2026-06-15

Bludit CMS, a popular content management system, contains a security flaw in its API plugin that allows unauthorized users to upload files. By exploiting this, an attacker can upload a malicious script to the server and take full control of the website. This could lead to the theft of sensitive data, website defacement, or a complete service outage.

Technologies: [Bludit](https://junglewise.ai/threats/technologies/bludit). Vendors: [Bludit](https://junglewise.ai/threats/vendors/bludit).

## Quick answers

**Is CVE-2026-38329 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-38329 being exploited in the wild.

**How severe is CVE-2026-38329?** Informational severity, with a CVSS score of 9.8, published 15 June 2026.

**Which products and versions are affected?** Bludit < 3.18.4.

**Is there a fix for CVE-2026-38329?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-38329 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-38329?** Check whether you run Bludit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Remote Code Execution (RCE) vulnerability exists in Bludit CMS versions prior to 3.18.4 within the API Plugin (bl-plugins/api/plugin.php). The vulnerability stems from two primary issues: a missing permission check (CWE-862) on the POST /api/files/{key} endpoint and a lack of file upload filtering (CWE-434). While other API endpoints verify write permissions, the file upload handler fails to do so, allowing any user with a valid API token (even read-only) to interact with it. Furthermore, the uploadFile() function does not validate file extensions or sanitize filenames, allowing an attacker to upload a .php file. Once uploaded, the script can be accessed directly via the web server to execute arbitrary commands. The issue is resolved in version 3.18.4.

## Affected products

- Bludit Bludit CMS < 3.18.4

## Timeline

- 2026-06-11: disclosed: Vulnerability details shared via GitHub Gist.
- 2026-06-15: advisory: CVE-2026-38329 published.

## References

- [https://gist.github.com/Ki1ro0133/8bd14bd4fc6fab81c907d838a7aeee55](https://gist.github.com/Ki1ro0133/8bd14bd4fc6fab81c907d838a7aeee55)

## Related threats

- [Bludit stored cross-site scripting in logo upload](https://junglewise.ai/threats/cve-2026-72576-bludit-stored-cross-site-scripting-in-logo-upload)
- [Bludit directory traversal in api/plugin.php](https://junglewise.ai/threats/cve-2026-50869-bludit-directory-traversal-in-api-plugin-php)
- [Bludit insufficient session expiration for disabled accounts](https://junglewise.ai/threats/cve-2026-46657-bludit-insufficient-session-expiration-for-disabled-accounts)
- [Bludit CMS broken access control via ghost sessions](https://junglewise.ai/threats/cve-2026-46656-bludit-cms-broken-access-control-via-ghost-sessions)
- [Bludit CMS reflected XSS in search plugin](https://junglewise.ai/threats/cve-2026-41456-bludit-cms-reflected-xss-in-search-plugin)