PatchTheCVEbludit vulnerabilities and fixes
Recent CVEs affecting bludit, with upgrade or downgrade steps. 4 tracked.
bludit has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-04-07. Highest priority: CVE-2026-25099 (score 56/100).
- CVE-2026-4420 MEDIUM 5.4 DOWNGRADE Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating functionality
- CVE-2026-25101 CRITICAL 9.8 UPGRADE Bludit allows user's session identifier to be set before authentication
- CVE-2026-25100 MEDIUM 5.4 UPGRADE Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality
- CVE-2026-25099 HIGH 8.8 UPGRADE Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and ex
FAQ
How do I fix bludit vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is bludit being exploited right now?
None of the tracked bludit CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which bludit CVE should I patch first?
CVE-2026-25099 currently ranks highest (56/100): Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and ex.