Bludit CMS flaws enable RCE, XSS attacks

27 March 2026 high vulnerability

Three vulnerabilities in Bludit CMS allow authenticated attackers to achieve remote code execution via unrestricted file upload, inject stored XSS through SVG uploads, and hijack sessions.

CERT Polska has disclosed three vulnerabilities affecting the Bludit content management system. CVE-2026-25099 is the most severe, allowing authenticated attackers with valid API tokens to upload arbitrary files through the API plugin without restriction, leading to remote code execution. This flaw was fixed in version 3.18.4.

CVE-2026-25100 affects Bludit's image upload functionality, enabling authenticated users with content privileges to upload SVG files containing malicious payloads that execute as stored XSS when victims access the resource URL. The uploaded content remains accessible without authentication. All versions up to 3.18.2 are vulnerable, and the vendor ceased communication during coordination, leaving the patching status of newer versions uncertain. CVE-2026-25101 involves session fixation where session identifiers can be set pre-authentication and persist post-authentication, enabling session hijacking. This issue was resolved in version 3.17.2.

The vulnerabilities were responsibly disclosed by researcher Arkadiusz Marta. Organizations running Bludit should prioritize upgrading to patched versions, particularly for CVE-2026-25099 which enables direct code execution.

Mentioned in this report

Vulnerabilities CVE-2026-25099pocCVE-2026-25100CVE-2026-25101

Detection guidance

Web Server Process Spawning Command Shell (Possible Bludit RCE via CVE-2026-25099)

ATT&CK T1059

Detects a web server or PHP process spawning a shell interpreter, consistent with webshell execution after arbitrary file upload in vulnerable Bludit API plugin. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Shell (Possible Bludit RCE)
id: a7faad64-454b-53dd-9de7-7afcb11fa893
status: experimental
description: 'Detects a web server or PHP-FPM/CGI process spawning a shell or command
  interpreter as a child process.

  This behaviour is consistent with post-exploitation execution of a web shell dropped
  through the

  Bludit API plugin arbitrary file upload vulnerability (CVE-2026-25099), which allows
  authenticated

  attackers with a valid API token to upload arbitrary files leading to remote code
  execution.

  '
references:
- CERT Polska Bludit CMS advisory (CVE-2026-25099)
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /httpd
    - /apache2
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    - /php-cgi
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ksh
    - /zsh
  filter:
    CommandLine|contains:
    - logrotate
    - healthcheck
    - cron.daily
  condition: selection and not filter
falsepositives:
- Legitimate CGI scripts or admin health-check scripts that intentionally invoke a
  shell from the web server process
- Package management or logrotate hooks executed from web server service context
level: high

Script File Written to Bludit Uploads Directory by Web Server Process

ATT&CK T1190

Detects creation of executable script files (.php, .phtml, .phar) within an uploads/content directory by a web server or PHP process, indicating exploitation of the Bludit API plugin arbitrary upload flaw (CVE-2026-25099). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Script File Written to Bludit Uploads Directory by Web Server Process
id: 2da11c96-6b42-5969-9b68-69bd965878c7
status: experimental
description: 'Detects a web server or PHP process (apache2, nginx, php-fpm, php-cgi)
  creating a file with an

  executable script extension inside an uploads or content directory, consistent with
  exploitation

  of CVE-2026-25099 (Bludit API plugin arbitrary file upload) leading to remote code
  execution via a

  dropped web shell.

  '
references:
- CERT Polska Bludit CMS advisory (CVE-2026-25099)
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
  category: file_event
  product: linux
detection:
  selection:
    Image|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    - /php-cgi
    TargetFilename|contains:
    - uploads
    - bl-content
    TargetFilename|endswith:
    - .php
    - .phtml
    - .php5
    - .phar
  condition: selection
falsepositives:
- Legitimate plugin or theme installation by an administrator that legitimately deploys
  PHP files into content directories
- CMS auto-update process writing new PHP files during a version upgrade
level: high

Suspicious Upload Request to Bludit API or Image Upload Endpoint

ATT&CK T1071.001

Detects HTTP POST requests to Bludit API or content-image upload endpoints delivering files with executable or SVG extensions, indicative of exploitation of CVE-2026-25099 or CVE-2026-25100. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Upload Request to Bludit API or Image Upload Endpoint
id: 864a0e54-95e0-5e17-9946-3073c458bebb
status: experimental
description: 'Detects HTTP POST requests to Bludit''s API or image upload endpoints
  where the uploaded resource

  has a .php/.phtml extension (arbitrary file upload, CVE-2026-25099) or a .svg extension
  (stored XSS

  via malicious SVG upload, CVE-2026-25100). Uploaded SVG payloads remain accessible
  without

  authentication once stored.

  '
references:
- CERT Polska Bludit CMS advisory (CVE-2026-25099, CVE-2026-25100)
author: Vorant
tags:
- attack.t1071.001
- attack.t1190
logsource:
  category: proxy
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
    - /api/
    - upload-images
    - ajax/upload
    cs-uri-stem|endswith:
    - .php
    - .phtml
    - .php5
    - .svg
  condition: selection
falsepositives:
- Legitimate content editors uploading valid SVG images or plugin files through the
  API with a valid token
- Automated content-management workflows that regularly upload media assets via the
  API endpoint
level: medium

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/03/CVE-2026-25099

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free