CVE-2026-38329: Bludit CMS before version 3

Synopsis

A remote code execution vulnerability exists in Bludit CMS before version 3.18.4, reachable over the network without any authentication. The POST /api/files/{key} endpoint in the API plugin skips both authorization checks and file extension validation, allowing any caller with a valid API token to upload a PHP script and run arbitrary code on the server. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched-image rebuild the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to reach the Bludit API service via HTTP/HTTPS to deliver the malicious upload request.

• AuthenticationNot required

  No account credentials or session are required; possession of any valid API token is sufficient and the endpoint performs no further authorization checks.

• Victim interactionNot required

  Exploitation is fully automated and requires no action from any user on the target system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layout, or environmental prerequisites are needed to achieve code execution.

Blast Radius

• An attacker executes arbitrary operating system commands and PHP code under the web server process account.
• All files readable by the web server process are exposed, including configuration files that may contain database credentials and API secrets.
• An attacker can write, overwrite, or delete any file the web server process has access to, altering application content and persisted data.
• The web server process can be crashed or consumed, taking the Bludit application offline for legitimate users.