CVE-2026-72576

5.4 Moyenne

Publiée le 10/08/2026 à 13:17 · Modifiée le 24/10/2026 à 17:10 · Analyse NVD reportée · Source : 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.

Traduire en français

Produits concernés

Bludit

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c	`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-79

Références

https://github.com/bludit/bludit
https://github.com/bludit/bludit/blob/dev/bl-kernel/ajax/logo-upload.php
https://www.bludit.com

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories