Bludit CMS versions 3.17.2 and 3.18.0 contain a stored XSS vulnerability (CVE-2026-4420)…
Bludit CMS versions 3.17.2 and 3.18.0 contain a stored XSS vulnerability (CVE-2026-4420) allowing authenticated attackers to execute JavaScript and potentially create admin accounts.
CERT Polska has disclosed a stored cross-site scripting vulnerability in Bludit, an open-source content management system. The vulnerability, tracked as CVE-2026-4420, exists in the page creation functionality where authenticated users with page creation privileges (Author, Editor, or Administrator roles) can inject malicious JavaScript payloads into the tags field of new articles. When victims visit the URL of the uploaded resource, the payload executes in their browser context. Notably, the uploaded resource is publicly accessible without authentication, expanding the attack surface.
The most severe impact of this vulnerability is the potential for privilege escalation. An attacker could craft a payload that automatically creates a new administrator account if the victim viewing the malicious page has sufficient privileges. This effectively allows lower-privileged authenticated users to elevate themselves to full administrative control of the Bludit installation.
CERT Polska coordinated disclosure with the vendor, but received no response regarding affected version ranges or mitigation details. Only versions 3.17.2 and 3.18.0 were confirmed vulnerable through testing; other versions may also be affected but remain untested. The vulnerability was responsibly reported by security researcher Yassin Abdelrazek.
Mentioned in this report
Detection guidance
Bludit Stored XSS Payload Injection via Page Tags Field
Detects HTTP requests to Bludit content-creation endpoints containing script tags or JavaScript event handlers in the tags/content parameters, indicative of stored XSS exploitation (CVE-2026-4420). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bludit Stored XSS Payload Injection via Page Tags Field
id: fb00d7f6-54d5-5cc4-84aa-ad179508c0a2
status: experimental
description: 'Detects HTTP POST requests to Bludit''s page/article creation or edit
endpoints where the tags or content
parameters contain script tags, javascript: URIs, or inline event handlers. This
matches the stored XSS
technique described in CVE-2026-4420, where authenticated Author/Editor users inject
JavaScript into the
tags field of new pages that later executes for any visitor of the published resource.
'
references:
- https://cert.pl
author: Vorant
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- /admin/new-content
- /admin/edit-content
- /admin/pages
selection_method:
cs-method: POST
selection_payload:
cs-uri-query|contains:
- <script
- 'javascript:'
- onerror=
- onload=
- onmouseover=
condition: selection_endpoint and selection_method and selection_payload
falsepositives:
- Legitimate content authors pasting HTML/embed code snippets that happen to include
the word 'script' for tutorials or documentation pages
- Automated content migration tools posting raw HTML fragments
level: high
tags:
- attack.t1059.007
- attack.initial_access
- cve.2026-4420
Bludit Users Database File Modified by Web Server Process
Detects unexpected modification of Bludit's users.php database file by the web server/PHP process outside of normal admin panel session flow, potentially indicating automated privilege escalation via an XSS-triggered account creation payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bludit Users Database File Modified by Web Server Process
id: ddb88a39-a43e-508a-a29d-02641f27bd38
status: experimental
description: 'Detects write access to Bludit''s bl-content/databases/users.php file
performed by the web server or PHP-FPM
process. In the CVE-2026-4420 attack chain, a stored XSS payload can silently issue
a request that creates a
new administrator account, resulting in an unexpected modification of the users
database file shortly after
a victim views the malicious page. This should be correlated with a preceding suspicious
page view request.
'
references:
- https://cert.pl
author: Vorant
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains: bl-content/databases/users.php
Image|endswith:
- /php-fpm
- /php
- /apache2
- /httpd
- /nginx
filter_admin_login:
ParentImage|contains: /admin/login
condition: selection and not filter_admin_login
falsepositives:
- Legitimate administrator password change or new user creation performed through
the normal admin login flow
- Backup or restore operations that touch the entire bl-content directory tree
level: medium
tags:
- attack.t1059.007
- attack.privilege_escalation
- cve.2026-4420
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4420
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free