CVE-2026-72576

Name of the Vulnerable Software and Affected Versions Bludit version 4.0.0-beta

Description A stored cross-site scripting (XSS) issue allows a low-privileged authenticated user with the Author role to inject arbitrary JavaScript. This occurs when a crafted SVG file is uploaded as the site logo via the '/admin/ajax/logo-upload' endpoint in bl-kernel/ajax/logo-upload.php. The system moves the uploaded file to the web root using the Filesystem::mv() function without calling sanitizeSVG() or transformImage(), despite SVG being included in the ALLOWED IMG EXTENSION and ALLOWED IMG MIMETYPES allow-lists. Consequently, a stored script tag within the SVG executes in the browser of any user who views the logo.

Recommendations As a temporary mitigation, restrict the use of the '/admin/ajax/logo-upload' endpoint or remove SVG from the ALLOWED IMG EXTENSION and ALLOWED IMG MIMETYPES allow-lists. At the moment, there is no information about a newer version that contains a fix for this vulnerability.