CVE-2026-25099
Remote Code Execution via Unrestricted File Upload in Bludit
Summary
Remote Code Execution via Unrestricted File Upload in Bludit
Original description
The description as published by the source.
Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution.
This issue was fixed in 3.18.4.
References
- advisory cert.pl
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- web github.com