CVE-2026-27742
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Bludit 3.16.2 contains a stored XSS vulnerability in the post content functionality. The application performs client-side sanitation but lacks server-side enforcement. An authenticated user can inject arbitrary JavaScript into post content, which is stored and rendered to other users without proper output encoding.
Risk Assessment
Risk includes session hijacking, credential theft, content manipulation, or other actions within the victim's privileges. An attacker can exploit this to target other users of the system.
Recommendation
Update Bludit to the latest version that includes a fix for this vulnerability. If an update is not possible, implement server-side validation and output encoding for all content fields.
Original NVD description (English source)
Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding. When viewed, the injected script executes in the context of the victim’s browser, allowing session hijacking, credential theft, content manipulation, or other actions within the user’s privileges.