CVE-2026-25099: Remote Code Execution via Unrestricted File Upload in Bludit
Published Mar 27, 2026
·Updated
Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution.
This issue was fixed in 3.18.4.
Affected Software
2 affected components
Bludit Bludit API plugin<3.18.4
Bludit bludit<3.18.4
Event History
Mar 27, 2026
CVE Published
via MITRE·11:55 AM
Data Sourced
via MITRE·11:55 AM
DescriptionWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeaknessAffected Software
May 7, 2026
Exploit Published
via ExploitDB·12:00 AM
Known Exploited
04:46 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-25099?
CVE-2026-25099 has a high severity rating due to its potential for Remote Code Execution through unrestricted file uploads.
2
How do I fix CVE-2026-25099?
To fix CVE-2026-25099, update the Bludit API plugin to version 3.18.4 or later.
3
Who is affected by CVE-2026-25099?
CVE-2026-25099 affects users of the Bludit API plugin versions prior to 3.18.4.
4
What type of vulnerability is CVE-2026-25099?
CVE-2026-25099 is a remote code execution vulnerability caused by unrestricted file uploads.
5
Can CVE-2026-25099 be exploited without authentication?
No, CVE-2026-25099 requires an authenticated user with a valid API token to exploit the vulnerability.