CVE-2026-25099

8.7 highEPSS 2.0%

High (8.7) in bludit bludit. EPSS 2.0% chance of exploitation in the next 30 days.

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2026-03-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

bludit:bludit

References

https://cert.pl/posts/2026/03/CVE-2026-25099
https://github.com/bludit/bludit/releases/tag/3.18.4

Check your stack JSON