CVE-2026-72576: Bludit 4.0.0-beta Stored XSS Vulnerability

CVE-2026-72576 Overview

CVE-2026-72576 is a stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta, an open-source flat-file content management system. A low-privileged authenticated user with the Author role can upload a crafted Scalable Vector Graphics (SVG) file as the site logo. The SVG contains an embedded <script> tag that executes in the browser of any user who subsequently loads the logo.

The flaw is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Because the logo is rendered site-wide, the injected script runs in the context of administrators and visitors alike, enabling session hijacking, credential theft, and cross-site actions.

Critical Impact
An authenticated Author-level attacker can execute arbitrary JavaScript in the browsers of administrators viewing any page that renders the site logo, enabling privilege escalation through session or credential compromise.

Affected Products

Bludit 4.0.0-beta
Bludit logo upload endpoint (bl-kernel/ajax/logo-upload.php)
Deployments allowing Author-role user registration or provisioning

Discovery Timeline

2026-08-10 - CVE-2026-72576 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72576

Vulnerability Analysis

Bludit exposes a logo upload endpoint accessible to authenticated users, including those holding the low-privileged Author role. The application accepts SVG files without stripping active content such as <script> elements, event handlers, or embedded JavaScript URIs. SVG is an XML-based format that browsers parse and execute as an active document when served with an image MIME type or embedded via <object> or <img> in some contexts.

Once uploaded, the file replaces the site logo referenced across the front end and administrative interface. Every user loading a page that renders the logo triggers execution of the embedded script in their browser session. The attacker can then exfiltrate session cookies, issue authenticated administrative requests, or pivot to broader compromise of the CMS.

The attack requires network access, authentication as an Author, and user interaction from a victim who loads the logo. Scope changes because code from the attacker's uploaded asset executes in the security context of other users' sessions.

Root Cause

The root cause is missing input sanitization and content-type enforcement in the logo upload handler at bl-kernel/ajax/logo-upload.php. The handler validates the file as an image based on extension or MIME hint but does not parse SVG content to strip scripting elements. It also does not restrict the accepted image formats to raster-only types such as PNG or JPEG.

Attack Vector

An attacker with Author credentials navigates to the site settings interface and submits a crafted SVG containing a <script> block or an onload attribute. The file is stored on disk under the Bludit uploads directory and referenced by the site template. Any visitor or administrator who loads a page containing the logo executes the payload. See the Bludit logo upload source for the affected handler and the Bludit repository for full context.

Detection Methods for CVE-2026-72576

Indicators of Compromise

SVG files present in the Bludit uploads directory containing <script>, onload, onerror, or javascript: strings
Recent modifications to the site logo file with a .svg extension where prior logos were raster formats
Author-role accounts issuing POST requests to bl-kernel/ajax/logo-upload.php
Outbound requests from administrator browsers to unfamiliar domains shortly after loading the admin panel

Detection Strategies

Scan the Bludit content directory for SVG files and inspect XML content for embedded scripts or event handler attributes
Review web server access logs for logo upload requests originating from non-administrator accounts
Alert on browser console errors or unexpected script execution reported through Content Security Policy violation endpoints

Monitoring Recommendations

Enable and monitor CSP report-uri or report-to endpoints for inline script violations on Bludit pages
Log all file uploads with hash, uploader identity, and MIME type for retrospective inspection
Track privilege changes and administrative actions performed within short windows after logo modifications

How to Mitigate CVE-2026-72576

Immediate Actions Required

Remove or replace any SVG logo currently deployed on Bludit 4.0.0-beta instances and inspect it for embedded scripts
Restrict logo upload permissions to trusted administrator roles until a patched release is available
Audit Author-role accounts and revoke any that are not required for operations
Rotate administrative session cookies and credentials if a malicious SVG upload is confirmed

Patch Information

No vendor patch is referenced in the current NVD record for CVE-2026-72576. Track the Bludit repository and the Bludit official website for a fixed release. Until a patched version is published, apply the workarounds below.

Workarounds

Reject SVG uploads at the application or reverse-proxy layer and allow only PNG, JPEG, or WebP for the site logo
Serve user-uploaded files from a separate origin with a restrictive Content Security Policy that blocks inline scripts
Configure the web server to send Content-Disposition: attachment and Content-Security-Policy: default-src 'none' headers for .svg responses
Sanitize any existing SVG assets with a library such as DOMPurify or svg-sanitizer before serving them

bash

# Nginx configuration example: block SVG execution as active content
location ~* \.svg$ {
    add_header Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; sandbox";
    add_header X-Content-Type-Options "nosniff";
    types { image/svg+xml svg; }
}

# Apache equivalent
<FilesMatch "\.svg$">
    Header set Content-Security-Policy "default-src 'none'; sandbox"
    Header set X-Content-Type-Options "nosniff"
</FilesMatch>