What is CVE-2026-25099?

CVE-2026-25099 is a high-severity vulnerability in Bludit, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-03-27.

How severe is CVE-2026-25099?

High severity. CVSS v3 base score is 8.8 out of 10.

Is CVE-2026-25099 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Arbitrary file upload in Bludit

CVE-2026-25099

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.

Vulnerability class: Unrestricted File Upload

EPSS: 0.019 (77.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Bludit — versions 0

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

Public proof-of-concept exploits

yahiahamza/CVE-2026-25099

References

cvd@cert.pl (Third Party Advisory, third-party-advisory)
cvd@cert.pl (release-notes, Release Notes)

Frequently asked questions

What is CVE-2026-25099?: CVE-2026-25099 is a high-severity vulnerability in Bludit, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 8.8/10. Published 2026-03-27.
How severe is CVE-2026-25099?: High severity. CVSS v3 base score is 8.8 out of 10.
Is CVE-2026-25099 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.