CVE-2026-25099 HIGH

CVE-2026-25099: Remote Code Execution via Unrestricted File Upload in Bludit

Vendor Bludit
Product Bludit
Weakness CWE-434 · Unrestricted file upload
Published March 27, 2026
Last update March 27, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

What the vulnerability does

01Description

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.

Key dates

02Disclosure timeline

March 27, 2026 CVE published
March 27, 2026 Record updated