CVE-2026-25099

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution.

This issue was fixed in 3.18.4.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-251005.4Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload pCVE-2026-251019.8Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. TCVE-2026-251047.8A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted CVE-2026-251058.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remoCVE-2026-251076.9ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files. An attacker who knCVE-2026-251088.8FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a speciallCVE-2026-251098.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote CVE-2026-25117.5The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to SQL Injection via the `multiformid` parameterCVE-2026-251103.3in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS.CVE-2026-251118.8An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote coCVE-2026-251127.8A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack.CVE-2026-251139.8The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting