Description
Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.
References (3)
Core 3
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/bludit/bludit/compare/5e5957c...77e85e7
Release Notes, Third Party Advisory x_refsource_confirm
https://github.com/bludit/bludit/releases/tag/3.9.0
Patch, Third Party Advisory x_refsource_confirm
https://github.com/bludit/bludit/commit/d0843a4070c7d7fa596a7eb2130be15383013487
Scores
CVSS v3
8.8
EPSS
0.0217
EPSS Percentile
84.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-434
Status
published
Products (1)
bludit/bludit
< 3.9.0
Published
Jun 03, 2019
Tracked Since
Feb 18, 2026