Bludit CMS stored XSS lets authenticated users create admins
Bludit CMS versions 3.17.2 and 3.18.0 contain a stored XSS vulnerability (CVE-2026-4420) allowing authenticated attackers to execute JavaScript and potentially create admin accounts.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska has disclosed a stored cross-site scripting vulnerability in Bludit, an open-source content management system. The vulnerability, tracked as CVE-2026-4420, exists in the page creation functionality where authenticated users with page creation privileges (Author, Editor, or Administrator roles) can inject malicious JavaScript payloads into the tags field of new articles. When victims visit the URL of the uploaded resource, the payload executes in their browser context. Notably, the uploaded resource is publicly accessible without authentication, expanding the attack surface.
The most severe impact of this vulnerability is the potential for privilege escalation. An attacker could craft a payload that automatically creates a new administrator account if the victim viewing the malicious page has sufficient privileges. This effectively allows lower-privileged authenticated users to elevate themselves to full administrative control of the Bludit installation.
CERT Polska coordinated disclosure with the vendor, but received no response regarding affected version ranges or mitigation details. Only versions 3.17.2 and 3.18.0 were confirmed vulnerable through testing; other versions may also be affected but remain untested. The vulnerability was responsibly reported by security researcher Yassin Abdelrazek.
Mentioned in this report
Detection guidance
Bludit Stored XSS Payload Injection via Page Tags Field
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to Bludit content-creation endpoints containing script tags or JavaScript event handlers in the tags/content parameters, indicative of stored XSS exploitation (CVE-2026-4420). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bludit Stored XSS Payload Injection via Page Tags Field
id: fb00d7f6-54d5-5cc4-84aa-ad179508c0a2
status: experimental
description: 'Detects HTTP POST requests to Bludit''s page/article creation or edit
endpoints where the tags or content
parameters contain script tags, javascript: URIs, or inline event handlers. This
matches the stored XSS
technique described in CVE-2026-4420, where authenticated Author/Editor users inject
JavaScript into the
tags field of new pages that later executes for any visitor of the published resource.
'
references:
- https://cert.pl
author: Vorant
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- /admin/new-content
- /admin/edit-content
- /admin/pages
selection_method:
cs-method: POST
selection_payload:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- onmouseover=
condition: selection_endpoint and selection_method and selection_payload
falsepositives:
- Legitimate content authors pasting HTML/embed code snippets that happen to include
the word 'script' for tutorials or documentation pages
- Automated content migration tools posting raw HTML fragments
level: high
tags:
- attack.t1059.007
- attack.initial-access
- cve.2026-4420
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4420
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs