Read the docs
TI-2026-62947 Aliases CVE-2026-93366GHSA-mx48-544j-vv99

Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints

Priority LOW 23CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid parameters to unprotected AJAX endpoints. Attackers can retrieve page UUIDs for all users via the content-get-list endpoint and then submit crafted POST requests to the list-images and delete-image endpoints in bl-kernel/ajax/ to access and destroy media files outside their own pages, bypassing the IMAGE_RESTRICT isolation control.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00189 8th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BluditBludit CMSup to 3.22.0; up to 4.0.0-beta-1—No fix listedCNA
  • Bludit CMS VendorBludit Affected up to 3.22.0; up to 4.0.0-beta-1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-93366
  2. 2026-10-03 Alias added: GHSA-mx48-544j-vv99

References

Other 1

  • TI-2019-12105 Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because… CVSS 3.1HIGH 8.8
  • TI-2024-16173 Bludit - Remote Code Execution (RCE) through Image API CVSS 4.0HIGH 8.9
  • TI-2024-16172 Bludit - Remote Code Execution (RCE) through File API CVSS 4.0HIGH 8.9
  • TI-2026-34301 Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions CVSS 3.1HIGH 8.8
  • TI-2023-15122 An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator… CVSS 3.1HIGH 8.8
  • TI-2020-13782 Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. CVSS 3.1HIGH 8.8
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences