PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-38329 Bludit CVE debrief

CVE-2026-38329 is a Remote Code Execution (RCE) vulnerability in Bludit CMS before version 3.18.4. The vulnerability is caused by the lack of authorization and file extension validation in the POST /api/files/{key} endpoint in bl-plugins/api/plugin.php. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server. For more information, see [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-38329) and [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-38329).

Vendor
Bludit
Product
Bludit CMS
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-16
Advisory published
2026-06-15
Advisory updated
2026-06-16

Who should care

Users of Bludit CMS before version 3.18.4 should update to the latest version to prevent this vulnerability from being exploited.

Technical summary

The vulnerability is caused by the lack of authorization and file extension validation in the POST /api/files/{key} endpoint in bl-plugins/api/plugin.php. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.

Defensive priority

High

Recommended defensive actions

  • Update Bludit CMS to version 3.18.4 or later.
  • Restrict access to the API Plugin.
  • Monitor for suspicious activity on the server.

Evidence notes

The vulnerability was reported via [ref-4](https://gist.github.com/Ki1ro0133/8bd14bd4fc6fab81c907d838a7aeee55).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-38329 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-38329

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-38329 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-38329

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.