CVE-2026-72576
MediumCVSS 5.4Summary
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo.
Risk Assessment
Malicious script in the logo executes in the browser of any user who loads the logo, potentially leading to data theft or session hijacking.
Recommendation
Update Bludit to a stable version that includes a fix for this vulnerability and restrict permissions for uploading SVG files.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.