CVE-2026-72576: Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.
Other sources
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload endpoint in bl-kernel/ajax/logo-upload.php moves the uploaded file directly to the web root via Filesystem::mv() without invoking sanitizeSVG() or transformImage(), while SVG is present in the ALLOWEDIMGEXTENSION and ALLOWEDIMGMIMETYPES allow-lists. A stored script tag in the SVG executes in the browser of any user who loads the logo.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72576?
CVE-2026-72576 has a medium severity score of 5.4.
How does CVE-2026-72576 exploit work?
CVE-2026-72576 allows a low-privileged authenticated user to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo.
Who is affected by CVE-2026-72576?
CVE-2026-72576 affects Bludit version 4.0.0-beta users with low-privileged authenticated roles, specifically those with the Author role.
How can I fix CVE-2026-72576?
To mitigate CVE-2026-72576, restrict the upload functionality to allow only safe file types and implement additional validation for uploaded files.
What kind of vulnerability is CVE-2026-72576 classified as?
CVE-2026-72576 is classified as a stored cross-site scripting (XSS) vulnerability.