CVE-2026-72576 in Bludit
Summary
by MITRE • 08/10/2026
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload endpoint in bl-kernel/ajax/logo-upload.php moves the uploaded file directly to the web root via Filesystem::mv() without invoking sanitizeSVG() or transformImage(), while SVG is present in the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists. A stored script tag in the SVG executes in the browser of any user who loads the logo.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical stored cross-site scripting flaw in Bludit version 4.0.0-beta that specifically targets the administrative upload functionality. The issue arises from insufficient input validation and sanitization processes within the logo upload endpoint, creating an attack vector that allows low-privileged users with Author role permissions to execute malicious code in the context of other users' browsers. The vulnerability stems from the application's failure to properly validate SVG files before storing them in the web root directory, effectively bypassing security controls designed to prevent malicious file uploads.
The technical implementation of this flaw occurs within the /admin/ajax/logo-upload endpoint located at bl-kernel/ajax/logo-upload.php where the Filesystem::mv() method directly moves uploaded files without applying necessary sanitization functions. The application's configuration permits SVG files through both ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists, creating a dangerous combination where legitimate SVG functionality becomes a conduit for malicious code execution. When an Author role user uploads a crafted SVG file containing embedded JavaScript, the script is stored in the web root and executed whenever any user loads the logo, making this a persistent stored XSS vulnerability that affects all users who view the compromised site.
The operational impact of this vulnerability extends beyond simple code execution as it provides attackers with the ability to perform session hijacking, data theft, and further privilege escalation within the application context. The stored nature of the vulnerability means that the malicious payload remains active even after the initial upload, continuously affecting all users who access pages displaying the compromised logo. This vulnerability directly maps to CWE-79: Improper Neutralization of Input During Web Page Generation, which is a fundamental weakness in web applications where user-provided data is not properly sanitized before being rendered in web pages. The attack vector aligns with ATT&CK technique T1566.001: Phishing via Social Media, as the vulnerability allows attackers to craft malicious SVG files that can be uploaded through legitimate administrative functions.
Mitigation strategies must address both immediate remediation and long-term architectural improvements to prevent similar vulnerabilities. Organizations should implement comprehensive SVG sanitization routines that strip all potentially dangerous elements and attributes from uploaded SVG files before storage, utilizing libraries specifically designed for SVG security validation such as svg-sanitizer or similar solutions. The application code should be modified to invoke sanitizeSVG() or transformImage() functions whenever SVG files are processed, ensuring that the ALLOWED_IMG_EXTENSIONS and ALLOWED_IMG_MIMETYPES allow-lists do not inadvertently permit malicious file types. Additionally, implementing a more restrictive upload validation process with proper content type checking and file format verification would prevent unauthorized file execution. The vulnerability also highlights the need for principle of least privilege implementation where administrative functions should validate all user inputs regardless of role permissions, and for regular security code reviews focusing on file upload handling processes to identify similar patterns that could lead to stored XSS vulnerabilities in other application components.