# Bludit CMS versions 3.17.2 and 3.18.0 contain a stored XSS vulnerability (CVE-2026-4420)…

Published: 2026-04-07 · Severity: high
Canonical: https://vorant.io/reports/55c988f7-c45b-4daa-8c11-b544f2e6a24c/bludit-cms-versions-3-17-2-and-3-18-0-contain-a-stored-xss-vulnerability-cve

> Bludit CMS versions 3.17.2 and 3.18.0 contain a stored XSS vulnerability (CVE-2026-4420) allowing authenticated attackers to execute JavaScript and potentially create admin accounts.

CERT Polska has disclosed a stored cross-site scripting vulnerability in Bludit, an open-source content management system. The vulnerability, tracked as CVE-2026-4420, exists in the page creation functionality where authenticated users with page creation privileges (Author, Editor, or Administrator roles) can inject malicious JavaScript payloads into the tags field of new articles. When victims visit the URL of the uploaded resource, the payload executes in their browser context. Notably, the uploaded resource is publicly accessible without authentication, expanding the attack surface.

The most severe impact of this vulnerability is the potential for privilege escalation. An attacker could craft a payload that automatically creates a new administrator account if the victim viewing the malicious page has sufficient privileges. This effectively allows lower-privileged authenticated users to elevate themselves to full administrative control of the Bludit installation.

CERT Polska coordinated disclosure with the vendor, but received no response regarding affected version ranges or mitigation details. Only versions 3.17.2 and 3.18.0 were confirmed vulnerable through testing; other versions may also be affected but remain untested. The vulnerability was responsibly reported by security researcher Yassin Abdelrazek.

## Mentioned in this report

- Vulnerabilities: CVE-2026-4420

## Detection guidance (public sample)

### Bludit Stored XSS Payload Injection via Page Tags Field

ATT&CK: T1059.007

Detects HTTP requests to Bludit content-creation endpoints containing script tags or JavaScript event handlers in the tags/content parameters, indicative of stored XSS exploitation (CVE-2026-4420). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Bludit Stored XSS Payload Injection via Page Tags Field
id: fb00d7f6-54d5-5cc4-84aa-ad179508c0a2
status: experimental
description: 'Detects HTTP POST requests to Bludit''s page/article creation or edit
  endpoints where the tags or content

  parameters contain script tags, javascript: URIs, or inline event handlers. This
  matches the stored XSS

  technique described in CVE-2026-4420, where authenticated Author/Editor users inject
  JavaScript into the

  tags field of new pages that later executes for any visitor of the published resource.

  '
references:
- https://cert.pl
author: Vorant
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - /admin/new-content
    - /admin/edit-content
    - /admin/pages
  selection_method:
    cs-method: POST
  selection_payload:
    cs-uri-query|contains:
    - <script
    - 'javascript:'
    - onerror=
    - onload=
    - onmouseover=
  condition: selection_endpoint and selection_method and selection_payload
falsepositives:
- Legitimate content authors pasting HTML/embed code snippets that happen to include
  the word 'script' for tutorials or documentation pages
- Automated content migration tools posting raw HTML fragments
level: high
tags:
- attack.t1059.007
- attack.initial_access
- cve.2026-4420
```

### Bludit Users Database File Modified by Web Server Process

ATT&CK: T1059.007

Detects unexpected modification of Bludit's users.php database file by the web server/PHP process outside of normal admin panel session flow, potentially indicating automated privilege escalation via an XSS-triggered account creation payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Bludit Users Database File Modified by Web Server Process
id: ddb88a39-a43e-508a-a29d-02641f27bd38
status: experimental
description: 'Detects write access to Bludit''s bl-content/databases/users.php file
  performed by the web server or PHP-FPM

  process. In the CVE-2026-4420 attack chain, a stored XSS payload can silently issue
  a request that creates a

  new administrator account, resulting in an unexpected modification of the users
  database file shortly after

  a victim views the malicious page. This should be correlated with a preceding suspicious
  page view request.

  '
references:
- https://cert.pl
author: Vorant
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: bl-content/databases/users.php
    Image|endswith:
    - /php-fpm
    - /php
    - /apache2
    - /httpd
    - /nginx
  filter_admin_login:
    ParentImage|contains: /admin/login
  condition: selection and not filter_admin_login
falsepositives:
- Legitimate administrator password change or new user creation performed through
  the normal admin login flow
- Backup or restore operations that touch the entire bl-content directory tree
level: medium
tags:
- attack.t1059.007
- attack.privilege_escalation
- cve.2026-4420
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4420

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/55c988f7-c45b-4daa-8c11-b544f2e6a24c/bludit-cms-versions-3-17-2-and-3-18-0-contain-a-stored-xss-vulnerability-cve.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup