VORANT. Threat Intelligence Sign in Get the full feed

Bludit CMS Stored XSS Enables Admin Takeover

medium vulnerability technology

A stored XSS flaw in Bludit CMS's page creation feature lets authenticated attackers hijack admin accounts via a crafted tags field payload.

CERT Polska coordinated disclosure of CVE-2026-4420, a stored cross-site scripting vulnerability in Bludit, an open-source flat-file CMS. The flaw resides in the page creation functionality: an attacker with page creation privileges (Author, Editor, or Administrator) can embed malicious JavaScript in the tags field of a newly created article. Since the uploaded resource is accessible without authentication, the payload executes in the browser of any visitor to that URL, including privileged users.

The most severe consequence is privilege escalation — if a victim with sufficient rights visits the malicious page, the payload can automatically create a new site administrator account, giving the attacker full control of the CMS. CERT Polska confirmed the vulnerability in Bludit versions 3.17.2 and 3.18.0, though other versions were not tested and may also be affected. The vendor was notified early in the disclosure process but did not respond with details on the vulnerable version range, leaving no official patch guidance at time of publication. Administrators running Bludit should restrict page creation privileges and monitor for unexpected administrator account creation until vendor remediation is available.

Mentioned in this report

Vulnerabilities CVE-2026-4420

Related reporting

Detection guidance

Bludit Unexpected Administrator Account Creation

ATT&CK T1078

Detects creation of new administrator accounts in Bludit CMS, indicative of privilege escalation via stored XSS payload execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Bludit Unexpected Administrator Account Creation
description: Detects creation of new administrator accounts in Bludit CMS. Stored
  XSS payloads in page tags can auto-create admin accounts when viewed by privileged
  users, enabling full CMS takeover.
tags:
- attack.privilege-escalation
- attack.t1078
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
    - /bl-content/databases/users.php
    TargetFilename|endswith: .php
  filter_legitimate_install:
    Image|contains:
    - /php
    - /mysql
    - /apache
  condition: selection and not filter_legitimate_install
falsepositives:
- Legitimate admin account provisioning during Bludit setup or maintenance windows
- Backup restoration processes that recreate user databases
level: high
id: 51eec9b4-b54f-5ada-a8f8-6f958a055f25
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4420

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free