CVE-2026-25099

HIGH

Remote Code Execution via Unrestricted File Upload in Bludit

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-25099 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 27, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Bludit

Browse Bludit / Bludit

Default status: unaffected

CVE ListBefore 3.18.4affected

Proofs of concept

2

Catalogued exploits

ExploitDBBludit CMS 3.18.4 - RCEExploitDB exploitby yahiaExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-25099 in Bludit CMS < 3.18.4 by uploading a PHP webshell via the unrestricted /api/files/<page-key> endpoint using a valid API token, then executing arbitrary commands on the target.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that exploits CVE-2026-25099 by uploading a PHP webshell to a vulnerable Bludit instance and then executing commands through it. All code is plain text, well-commented, and directly implements the described exploit steps: retrieving a page key, uploading a webshell, verifying RCE, and providing an interactive shell. No obfuscation, concealed payloads, persistence mechanisms, credential exfiltration, or unrelated remote access are present.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareBludit CMS
Attack typesremote code executionunrestricted file upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by uploading a PHP webshell and executing arbitrary commands, which is the definition of an exploit.

exploits/multiple/webapps/52553.py:50-69exploits/multiple/webapps/52553.py:72-80

Requirements

  • Valid Bludit API tokenexploits/multiple/webapps/52553.py:88
  • Target running Bludit CMS version < 3.18.4 with API plugin enabledexploits/multiple/webapps/52553.py:6

Observed behavior

  • Retrieves a page key from /api/pages using the provided tokenexploits/multiple/webapps/52553.py:33-47
  • Uploads a PHP file containing a command execution webshell to /api/files/<page-key>exploits/multiple/webapps/52553.py:50-69
  • Executes arbitrary system commands via the uploaded webshellexploits/multiple/webapps/52553.py:72-80
  • Provides an interactive shell for continuous command executionexploits/multiple/webapps/52553.py:124-138
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
Payload withheldThe script uploads a minimal PHP webshell to the target server as part of the documented exploit. This is the expected behavior for an RCE PoC targeting an unrestricted file upload vulnerability.exploits/multiple/webapps/52553.py:53
Command Execution
Payload withheldThe uploaded webshell executes arbitrary commands via PHP's system() function. This is the core of the RCE demonstration and is consistent with the stated exploit goal.exploits/multiple/webapps/52553.py:53
Interactive Shell
Payload withheldThe script provides an interactive command loop that sends user-supplied commands to the uploaded webshell. This is a standard feature of RCE PoCs and does not indicate hidden backdoor behavior.exploits/multiple/webapps/52553.py:125-138
Review boundaries

What the analysis did not establish

  • Only the supplied text file (52553.py) was reviewed; no external dependencies, libraries, or referenced resources were inspected.
  • The review does not assess whether the exploit works as claimed or whether the target vulnerability is correctly identified.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubyahiahamza/CVE-2026-25099Repository PoCby yahiahamza0Exploit3 files

173.4 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-25099 in Bludit CMS by uploading a PHP webshell via the unrestricted API file upload endpoint and providing an interactive command execution interface.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that exploits CVE-2026-25099 by uploading a PHP webshell to a vulnerable Bludit instance and providing command execution. The script's behavior is fully consistent with its stated purpose. No concealed executable behavior, unrelated payloads, persistence mechanisms, or operator-directed harm beyond the declared exploit were observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareBludit CMS
Attack typesRemote Code ExecutionUnrestricted File Upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by uploading a PHP webshell and executing commands on the target, which is the definition of an exploit.

CVE-2026-25099.py:50-69CVE-2026-25099.py:72-80CVE-2026-25099.py:1

Requirements

  • Valid Bludit API tokenCVE-2026-25099.py:88
  • Target running vulnerable Bludit version (< 3.18.4) with API plugin enabledCVE-2026-25099.py:1README.md:5

Observed behavior

  • Retrieves a valid page key from the target Bludit APICVE-2026-25099.py:33-47
  • Uploads a PHP webshell file to the target server via the unrestricted file upload endpointCVE-2026-25099.py:50-69
  • Executes arbitrary operating system commands on the target server through the uploaded webshellCVE-2026-25099.py:72-80
  • Provides an interactive shell for continuous command executionCVE-2026-25099.py:124-138
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
Payload withheldThe script uploads a minimal PHP webshell to the target server to achieve RCE, which is the documented exploit mechanism for CVE-2026-25099.CVE-2026-25099.py:53
Command Execution
Payload withheldThe uploaded webshell executes arbitrary commands on the target server, which is the intended RCE outcome of the exploit.CVE-2026-25099.py:53
Network Request
Payload withheldThe script sends a POST request to the vulnerable API endpoint to upload the webshell, matching the CVE description.CVE-2026-25099.py:56-61
Review boundaries

What the analysis did not establish

  • One non-text media file (screenshots/poc-execution.jpg) was not analyzed; its content is not needed for classification.
  • The evidence does not include the target application source code; analysis is based solely on the provided exploit script and documentation.
  • One non-text file (screenshots/poc-execution.jpg) was present in the repository but not analyzed; it is a screenshot referenced in the README and is unlikely to contain executable backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3