CVE-2026-72576

MEDIUM 5.4

Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.

CWE	CWE-79
Vendor	bludit
Product	bludit
Published	Aug 10, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for bludit bludit

Be the first to know when new medium vulnerabilities affecting bludit bludit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Bludit / Bludit

4.0.0-beta

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bludit.com: https://www.bludit.com github.com: https://github.com/bludit/bludit github.com: https://github.com/bludit/bludit/blob/dev/bl-kernel/ajax/logo-upload.php

Credits

Nurmurodov Asadbek