CVE-2026-25100
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedBludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload privileges (such as Author, Editor, or Administrator) can upload an SVG file containing a malicious payload, which is executed when a victim visits the URL of the uploaded resource. The uploaded resource itself is accessible without authentication. The vendor was notified early about this vulnerability, but stopped responding in the middle of coordination. All versions up to 3.18.2 are considered to be vulnerable, future versions might also be vulnerable.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceBludit CMS allows authenticated users with content upload privileges to upload files through its image upload functionality. An attacker can upload a specially crafted SVG file containing JavaScript payloads. When any user visits the URL of the uploaded SVG file, the embedded malicious script executes in their browser, enabling session hijacking or other XSS-based attacks. The uploaded files are served statically without sanitization, and access to view them does not require authentication.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 3.18.2CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Confirm Bludit CMS is installedLook for Bludit installation directories (commonly 'bludit' or 'cms' under web root) and identify the version file, typically named 'version.php' in the root directoryAffected if Bludit CMS is found running on the server
-
Check the installed Bludit versionOpen the version file and compare the version number to 3.18.2 - the version is typically stored in a constant like BLUDIT_VERSIONAffected if The installed version is lower than 3.18.2 (e.g., 3.18.1, 3.18.0, or earlier)
-
Verify if user authentication and upload functionality is accessibleCheck if the /admin/login page exists and if authenticated users can access the content editor where image upload functionality is availableAffected if The CMS admin panel is accessible and users with content privileges can access the image upload feature
-
Confirm SVG upload capability existsCheck if the image upload handler at /admin/ajax/upload-images accepts SVG file types - test by attempting to upload a benign SVG file or by reviewing the upload validation code for allowed extensionsAffected if SVG file uploads are permitted by the upload handler
-
Verify uploaded files are served without sanitizationCheck if uploaded SVG files are served from the /media directory directly without server-side processing - attempt to access an uploaded SVG file via its direct URL and inspect whether it renders as raw SVGAffected if SVG files are served as static content accessible via direct URL without sanitization processing
If Bludit version is below 3.18.2 and the CMS allows authenticated users to upload files including SVG format, then the environment is vulnerable to CVE-2026-25100.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped3.18.2
Implement strict validation of uploaded SVG files, either by blocking SVG uploads entirely and allowing only safe image formats, or by sanitizing SVG content to remove script elements, event handlers, and external resource references before serving.
Bludit 3.18.2 or later (verify fixed release on GitHub)
- 1. Check the current Bludit installation version by accessing the admin dashboard or checking the version file
- 2. Navigate to the official Bludit GitHub repository at github.com to verify if version 3.18.2 or a later stable release contains the security fix
- 3. If a newer version (3.18.2 or later) is available with security patches, download and install the update following Bludit's standard upgrade procedure
- 4. Backup the existing installation and database before performing the upgrade
- 5. After upgrading, verify that SVG file upload functionality is either restricted or that SVG files are properly sanitized
- 6. Test the fix by attempting to upload a benign SVG file and confirming it does not execute arbitrary JavaScript
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,088.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-25100 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-25100 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data