CVE-2026-25099

Remote Code Execution via Unrestricted File Upload in Bludit

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.

Affected

Bludit

CVSS v4.0 CERT

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

1.92% chance of exploitation in the next 30 days, 80th percentile

Published

2026-03-27

Proof-of-concept exploits (1)

• yahiahamza/CVE-2026-250990★ · 2026-03-28

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52553

Security advisories

• https://cert.pl/posts/2026/03/CVE-2026-25099
• bludit/bludit/releases/tag/3.18.4

References

• CVE Record
• NVD entry

Related

• CVE-2026-5027