Description
Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload privileges (such as Author, Editor, or Administrator) can upload an SVG file containing a malicious payload, which is executed when a victim visits the URL of the uploaded resource. The uploaded resource itself is accessible without authentication. The vendor was notified early about this vulnerability, but stopped responding in the middle of coordination. All versions up to 3.18.2 are considered to be vulnerable, future versions might also be vulnerable.
INFO
Published Date :
2026-03-27T11:55:17.543Z
Last Modified :
2026-03-27T12:43:37.644Z
Source :
CERT-PL
AFFECTED PRODUCTS
The following products are affected by CVE-2026-25100 vulnerability.
| Vendors | Products |
|---|---|
| Bludit |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-25100.
