CVE-2026-50869: An issue in the api/plugin

Synopsis

A directory traversal vulnerability in the api/plugin.php component of Bludit v3.19.0 allows an unauthenticated attacker to send a crafted HTTP request over the network and navigate outside the intended file path boundaries. No authentication or victim interaction is needed, and the attack is reliable to execute. Successful exploitation gives an attacker full read access to sensitive files, the ability to tamper with stored data, and the ability to disrupt service availability. HarborGuard is tracking this advisory for patch availability as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Bludit api/plugin.php endpoint over the network; any internet-exposed or internally routable instance is in scope.

• AuthenticationNot required

  No account or credentials are needed; the malicious request can be sent by any unauthenticated party.

• Victim interactionNot required

  No user action is required; the attacker sends the crafted request directly to the server without involving any end user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental setup.

Blast Radius

• Reads arbitrary files from the server filesystem, including configuration files, credentials, and application secrets stored outside the web root.
• Modifies or overwrites files accessible through the traversal path, corrupting application data or injecting malicious content.
• Disrupts availability of the Bludit service by deleting or corrupting critical application files.
• Provides a foothold for further compromise if read access exposes private keys, database passwords, or other authentication material.