Bludit vulnerabilities
We track 9 vulnerabilities in Bludit products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on June 8, 2026.
Latest Bludit vulnerabilities
- 7.1 High severity
bludit: Improper Removal of Sensitive Information Before Storage or Transfer
Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain access via persistent authentication tokens. When an administrator disables a user account, the appli
- 8.8 High severity
bludit: Improper Authorization
Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked us
- 9.8 Critical severity
Bludit: Session Fixation
Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue
- 8.8 High severity
Bludit: Unrestricted Upload of File with Dangerous Type
Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.
- 8.2 High severity
Bludit: Improper Authentication
Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the user token. This allows attackers to authenticate against the Bludit API.
- 7.5 High severity
Bludit: Use of Password Hash With Insufficient Computational Effort
Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force attacks due to the inherent speed of SHA-1. In addition, the salt that is computed by Bludit is generated with a non-crypto
- 8.8 High severity
Bludit: Session Fixation
A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or any other user into authorizing a session ID of their choosing.
- 8.8 High severity
Bludit: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP file
- 8.1 High severity
Bludit: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of