CVE-2026-25099 — Remote Code Execution via Unrestricted File Upload in Bludit
Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to…
Published: 2026-03-27 · CVSS: 8.7 · CVSS 4.0
Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7