Description
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.
Published: 2026-08-10
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A stored cross‑site scripting flaw in Bludit 4.0.0‑beta permits an authenticated user with the Author role to upload a specially crafted SVG file as the site logo, embedding a <script> tag. When the logo is viewed by any visitor, the embedded script runs in the victim’s browser, enabling arbitrary client‑side code execution. This vulnerability allows attackers to deface the site, steal session cookies, or perform other client‑side attacks. The weakness is classified as CWE‑79.

Affected Systems

Bludit Bludit 4.0.0‑beta is affected. No other product or version information is provided.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity; EPSS is not available and the vulnerability is not listed in CISA KEV. The attack requires the user to be authenticated as an Author, which is a relatively low privilege but still attainable by many site contributors. Because the flaw is a stored XSS, its impact depends on the number and type of visitors who view the logo, but any such user is exposed. Exploitation is straightforward once the user supplies an SVG upload; no additional network or privilege escalation steps are needed.

Generated by OpenCVE AI on August 10, 2026 at 19:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Bludit to a version that includes a fix for logo upload sanitization.
  • If an upgrade cannot be applied immediately, configure the application or web server to reject SVG uploads to the logo directory, or disable the logo upload feature entirely.
  • Restrict the set of allowed image types to exclude SVG files or implement server‑side validation that strips script elements from uploaded images.

Generated by OpenCVE AI on August 10, 2026 at 19:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 10 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Bludit
Bludit bludit
Vendors & Products Bludit
Bludit bludit

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload endpoint in bl-kernel/ajax/logo-upload.php moves the uploaded file directly to the web root via Filesystem::mv() without invoking sanitizeSVG() or transformImage(), while SVG is present in the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists. A stored script tag in the SVG executes in the browser of any user who loads the logo. A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.

Mon, 10 Aug 2026 11:00:00 +0000

Type Values Removed Values Added
Description A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload endpoint in bl-kernel/ajax/logo-upload.php moves the uploaded file directly to the web root via Filesystem::mv() without invoking sanitizeSVG() or transformImage(), while SVG is present in the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists. A stored script tag in the SVG executes in the browser of any user who loads the logo.
Title Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Bludit Bludit
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-10T13:11:31.584Z

Reserved: 2026-08-10T10:32:53.854Z

Link: CVE-2026-72576

cve-icon Vulnrichment

Updated: 2026-08-10T13:11:27.009Z

cve-icon NVD

Status : Deferred

Published: 2026-08-10T11:17:30.407

Modified: 2026-08-28T18:51:39.823

Link: CVE-2026-72576

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T20:00:04Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')