Executive brief
Bludit, a popular open-source content management system, contains a security flaw in its file upload system. An authorized administrator can bypass security restrictions to save files in unauthorized locations on the web server. This could allow an attacker to overwrite critical system configuration files, potentially leading to a complete takeover of the website or server.
Technical details
A directory traversal vulnerability exists in the `uploadFile()` function within `bl-plugins/api/plugin.php` of Bludit v3.19.0. The application fails to sanitize the `filename` parameter from multipart form data, directly appending it to the upload path. An authenticated attacker with administrator privileges can provide a crafted filename containing path traversal sequences (e.g., `../../../../.htaccess`). While the application blocks some script extensions, it does not normalize path segments, enabling the placement of configuration files like `.htaccess` or `.user.ini` in sensitive directories. This can lead to arbitrary PHP code execution or filesystem integrity loss depending on the server configuration.
Affected products
- Bludit Bludit 3.19.0
Timeline
- 2026-06-13: disclosed: Initial discovery and Gist publication
- 2026-06-15: advisory: CVE-2026-50869 published by NVD/MITRE