CVE-2026-25099CWE-434

Remote Code Execution via Unrestricted File Upload in Bludit

High · published March 27, 2026

CVSS v4.0
8.7
EPSS
2%
Percentile
79.7
In the wild
Unconfirmed
What it is

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution.

This issue was fixed in 3.18.4.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.01919 · 79.7th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-03-27T11:55Z
EPSS history
Timeline
  • 27 MAR 11:55Z
    Remote Code Execution via Unrestricted File Upload in Bludit
    cvelistv5