CVE-2023-53907CWE-22

Bludit 3.13.1 Authenticated Arbitrary File Download via Backup Plugin

High · published December 17, 2025

CVSS v4.0
7.1
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files. Attackers can exploit the plugin's download functionality by manipulating file path parameters to read sensitive system files through directory traversal.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00811 · 56.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-12-17T22:44Z
EPSS history
Timeline
  • 17 DEC 22:44Z
    Bludit 3.13.1 Authenticated Arbitrary File Download via Backup Plugin
    cvelistv5