Bludit CMS up to 3.22.0/4.0.0-beta-1 Pages pages.class.php Pages::edit type/username dynamically-determined object attributes

Summaryinfo

A vulnerability categorized as problematic has been discovered in Bludit CMS up to 3.22.0/4.0.0-beta-1. Affected is the function Pages::edit of the file bl-kernel/pages.class.php of the component Pages. The manipulation of the argument type/username results in dynamically-determined object attributes. This vulnerability is identified as CVE-2026-93364. The attack can be executed remotely. There is not any exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Bludit CMS up to 3.22.0/4.0.0-beta-1. Affected is the function Pages::edit of the file bl-kernel/pages.class.php of the component Pages. The manipulation of the argument type/username with an unknown input leads to a dynamically-determined object attributes vulnerability. CWE is classifying the issue as CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. This is going to have an impact on integrity. CVE summarizes:

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and username through the Pages::edit() function in bl-kernel/pages.class.php, which iterates all fields declared in dbFields without per-field authorization, enabling an Author to convert pages to static site-wide navigation entries or transfer page ownership to arbitrary accounts.

The advisory is shared for download at gist.github.com. This vulnerability is traded as CVE-2026-93364 since 09/17/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

By approaching the search of inurl:bl-kernel/pages.class.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 074773eff34b91c002ab9d99029a3edca4934bf1 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Vendor

• Bludit

Name

• CMS

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22.0
• 4.0.0-beta-1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion