An authenticated attacker with a valid API token can exploit the Bludit API plugin to upload files of any type and extension without restriction. This flaw, identified as CWE‑434, allows the attacker to execute the uploaded file, resulting in Remote Code Execution and full compromise of the system.

Bludit, all releases prior to 3.18.4 are affected. The vulnerability has been corrected in version 3.18.4 and later.

The CVSS score of 8.7 indicates a high severity of exploitation risk, though the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers require authentication and a valid API token, but once these prerequisites are satisfied, they can upload malicious files and trigger execution.