CVE-2026-25099 - Vulnerability Analysis

Overview

Bludit API plugin before 3.18.4 contains an unrestricted file upload vulnerability caused by lack of file type validation, letting authenticated attackers with valid API tokens upload and execute arbitrary files, exploit requires valid API token.

Severity & Score

Impact

Authenticated attackers can upload and execute arbitrary files, leading to remote code execution and full system compromise.

Mitigation

Update to version 3.18.4 or later.

References

• https://cert.pl/posts/2026/03/CVE-2026-25099
• https://github.com/bludit/bludit/releases/tag/3.18.4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner