Bludit CMS Stored XSS Enables Admin Takeover
A stored XSS flaw in Bludit CMS's page creation feature lets authenticated attackers hijack admin accounts via a crafted tags field payload.
Sourcecert.pl — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska coordinated disclosure of CVE-2026-4420, a stored cross-site scripting vulnerability in Bludit, an open-source flat-file CMS. The flaw resides in the page creation functionality: an attacker with page creation privileges (Author, Editor, or Administrator) can embed malicious JavaScript in the tags field of a newly created article. Since the uploaded resource is accessible without authentication, the payload executes in the browser of any visitor to that URL, including privileged users.
The most severe consequence is privilege escalation — if a victim with sufficient rights visits the malicious page, the payload can automatically create a new site administrator account, giving the attacker full control of the CMS. CERT Polska confirmed the vulnerability in Bludit versions 3.17.2 and 3.18.0, though other versions were not tested and may also be affected. The vendor was notified early in the disclosure process but did not respond with details on the vulnerable version range, leaving no official patch guidance at time of publication. Administrators running Bludit should restrict page creation privileges and monitor for unexpected administrator account creation until vendor remediation is available.
Mentioned in this report
Detection guidance
Bludit Unexpected Administrator Account Creation
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of new administrator accounts in Bludit CMS, indicative of privilege escalation via stored XSS payload execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Bludit Unexpected Administrator Account Creation
description: Detects creation of new administrator accounts in Bludit CMS. Stored
XSS payloads in page tags can auto-create admin accounts when viewed by privileged
users, enabling full CMS takeover.
tags:
- attack.privilege-escalation
- attack.t1078
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- /bl-content/databases/users.php
TargetFilename|endswith: .php
filter_legitimate_install:
Image|contains:
- /php
- /mysql
- /apache
condition: selection and not filter_legitimate_install
falsepositives:
- Legitimate admin account provisioning during Bludit setup or maintenance windows
- Backup restoration processes that recreate user databases
level: high
id: 51eec9b4-b54f-5ada-a8f8-6f958a055f25
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-4420
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs