Bludit CMS stored XSS enables admin takeover

Bludit CMS versions 3.17.2 and 3.18.0 contain a stored XSS flaw in page tags that authenticated users can exploit to create rogue administrators.

CERT Polska has disclosed CVE-2026-4420, a stored cross-site scripting vulnerability in Bludit content management system. An authenticated attacker with page creation privileges (Author, Editor, or Administrator roles) can inject malicious JavaScript into the tags field when creating new articles. The payload executes when any user visits the published resource URL, which is publicly accessible without authentication.

The vulnerability's critical impact stems from its potential for privilege escalation: an attacker can craft payloads that automatically create new administrator accounts if the victim viewing the malicious page has sufficient privileges. This allows lateral movement from lower-privileged authenticated positions to full administrative control. Versions 3.17.2 and 3.18.0 have been confirmed vulnerable through testing, though other versions may also be affected. The vendor was notified but did not respond with version range details or remediation timelines.

title: Bludit CMS - Script Injection in Content Tags Field
id: 001bbeb1-689a-5a05-b311-ed2273182b57
status: experimental
description: Detects HTTP POST requests to Bludit content creation/edit endpoints
  where the tags parameter contains inline script or event-handler payloads, consistent
  with CVE-2026-4420 stored XSS exploitation.
references:
- CVE-2026-4420
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: POST
    cs-uri-stem|contains:
    - /admin/new-content
    - /admin/edit-content
    - /admin/ajax/
  selection_payload:
    cs-uri-query|contains:
    - <script
    - onerror=
    - onload=
    - 'javascript:'
    c-request-body|contains:
    - <script
    - onerror=
    - onload=
    - 'javascript:'
  condition: selection_endpoint and selection_payload
falsepositives:
- Content editors legitimately pasting HTML snippets containing script-like text for
  documentation purposes
- Automated vulnerability scanners testing the CMS for XSS
level: high
tags:
- attack.t1059.007
- attack.execution
author: Vorant

title: Bludit CMS - Admin Account Creation Immediately After Page View
id: ebcfb73f-fa62-55c6-8a0d-4891a7a9faa8
status: experimental
description: Detects a POST request to Bludit's user management endpoint granting
  the administrator role shortly after a viewer session loads a published page, indicating
  the XSS payload auto-submitted a privilege-escalating account creation request rather
  than a manual admin action from the panel.
references:
- CVE-2026-4420
logsource:
  category: webserver
detection:
  selection_add_user:
    cs-method: POST
    cs-uri-stem|contains:
    - /admin/users/add
    - /admin/new-user
    - /admin/ajax/add-user
  selection_role:
    cs-uri-query|contains: role=admin
    c-request-body|contains: role=admin
  filter_normal_referer:
    cs-referer|contains:
    - /admin/users
    - /admin/new-user
  condition: selection_add_user and selection_role and not filter_normal_referer
falsepositives:
- Legitimate administrators bulk-creating new admin accounts through the panel where
  referer header is stripped or missing
- Automation/API integrations that manage Bludit users programmatically without a
  browser referer
level: high
tags:
- attack.t1098
- attack.persistence
- attack.privilege_escalation
author: Vorant

title: Bludit Users Database Modified by Web Process Outside Admin Workflow
id: d9b7fdf6-315d-5472-a5d7-3d111cd56561
status: experimental
description: Detects direct writes to Bludit's local user database file performed
  by the web server/PHP process shortly after an unauthenticated page view, which
  may indicate a stored XSS payload silently created or elevated a local account rather
  than a legitimate administrator action.
references:
- CVE-2026-4420
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
    - bl-content/databases/users.php
    - bl-content/databases/users.json
  selection_process:
    Image|endswith:
    - /php-fpm
    - /php-cgi
    - /httpd
    - /apache2
    - /nginx
  condition: selection and selection_process
falsepositives:
- Normal administrator account creation or password changes performed through the
  Bludit admin panel
- CMS backup or migration scripts that rewrite the users database file
level: medium
tags:
- attack.t1078.003
- attack.persistence
- attack.defense_evasion
author: Vorant

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4420