CVE-2026-25099 — Remote Code Execution via Unrestricted File Upload in Bludit

CVE-2026-25099

Remote Code Execution via Unrestricted File Upload in Bludit PUBLISHED

Description (CNA)

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.

Affected (CNA)

Vendor / product	Versions
Bludit / Bludit	affected 0 before 3.18.4

CWE

CWE-434

References

https://cert.pl/posts/2026/03/CVE-2026-25099
https://github.com/bludit/bludit/releases/tag/3.18.4

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.