CVE-2026-72576: Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload

Published Aug 10, 2026

Updated

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.

Affected Software

1 affected component

Bludit Bludit 4.0.0-beta=4.0.0-beta

Event History

Aug 10, 2026

CVE Published

via MITRE·10:41 AM

Data Sourced

via MITRE·10:41 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72576?

CVE-2026-72576 has a medium severity score of 5.4.

How does CVE-2026-72576 exploit work?

CVE-2026-72576 allows a low-privileged authenticated user to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo.

Who is affected by CVE-2026-72576?

CVE-2026-72576 affects Bludit version 4.0.0-beta users with low-privileged authenticated roles, specifically those with the Author role.

How can I fix CVE-2026-72576?

To mitigate CVE-2026-72576, restrict the upload functionality to allow only safe file types and implement additional validation for uploaded files.

What kind of vulnerability is CVE-2026-72576 classified as?

CVE-2026-72576 is classified as a stored cross-site scripting (XSS) vulnerability.