CVE-2026-38329: Critical severity Bludit Bludit CMS vulnerability
Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bludit CMSto a version that resolves this vulnerability.Fixed in 3.18.4 - Remove
Remove
Bludit API pluginfrom your environment.Uninstall the API Plugin to remove the vulnerable POST /api/files/{key} endpoint if it is not required.
- Configuration
Disable the API Plugin in Bludit if it is not required to prevent use of the POST /api/files/{key} endpoint.
Bludit API plugin enabled = false - Compensating control
Restrict access to the POST /api/files/{key} endpoint (or the API plugin) using network controls or a WAF to trusted IPs to block unauthorized uploads.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-38329?
CVE-2026-38329 has a critical severity rating of 9.8 according to the CVSS 3.1 scoring system.
What is CVE-2026-38329?
CVE-2026-38329 is a vulnerability in Bludit CMS that allows Remote Code Execution via the API Plugin due to improper authorization checks.
How do I fix CVE-2026-38329?
To fix CVE-2026-38329, upgrade Bludit CMS to version 3.18.4 or later where the vulnerability has been addressed.
What are the implications of CVE-2026-38329?
Exploiting CVE-2026-38329 can allow an attacker to upload malicious PHP scripts, potentially leading to full control over the web server.
Who is affected by CVE-2026-38329?
All users of Bludit CMS versions prior to 3.18.4 are affected by CVE-2026-38329.