CVE-2026-72576
Received Received - Intake

Stored XSS in Bludit via Malicious SVG Logo Upload

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72576
EUVD
EUVD-2026-55230

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
bludit bludit 4.0.0_beta
bludit bludit 4.0.0-beta

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta. A low-privileged authenticated user with the Author role can upload a malicious SVG file as the site logo. The file is moved directly to the web root without proper sanitization, allowing the SVG to execute arbitrary JavaScript when loaded by other users.

Detection Guidance

Check for unauthorized SVG files in the web root or logo directory. Inspect the /admin/ajax/logo-upload endpoint for unexpected file uploads. Review browser console logs for stored XSS payloads in the logo SVG.

Impact Analysis

An attacker could steal user sessions, deface the website, or perform actions on behalf of users. Since the payload is stored in the logo, any visitor viewing the site would unknowingly execute the malicious script.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if user sessions or data are compromised.

Mitigation Strategies

Remove any unauthorized SVG files from the web root. Update Bludit to a patched version if available. Restrict file uploads to trusted users and validate SVG content strictly. Monitor for unusual JavaScript execution in the logo area.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart