CVE-2026-72576

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72576", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-10T10:32:53.854Z", "datePublished": "2026-08-10T10:41:03.564Z", "dateUpdated": "2026-08-10T13:11:31.584Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:53.052Z"}, "title": "Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload", "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.</p>"}]}], "affected": [{"vendor": "Bludit", "product": "Bludit", "versions": [{"version": "4.0.0-beta", "status": "affected", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://www.bludit.com", "name": "Vendor", "tags": ["third-party-advisory"]}, {"url": "https://github.com/bludit/bludit", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/bludit/bludit/blob/dev/bl-kernel/ajax/logo-upload.php", "name": "Vulnerable File", "tags": ["technical-description"]}], "credits": [{"lang": "en", "value": "Nurmurodov Asadbek", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "timeline": [{"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "CVE Reserved"}, {"time": "2026-08-10T10:32:53.000Z", "lang": "en", "value": "Public Disclosure"}], "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-10T10:32:53.000Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-10T13:11:17.554196Z", "id": "CVE-2026-72576", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T13:11:31.584Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72576", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T13:11:17.554196Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-10T13:11:27.009Z"}}], "cna": {"title": "Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Nurmurodov Asadbek"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Bludit", "product": "Bludit", "versions": [{"status": "affected", "version": "4.0.0-beta", "versionType": "semver"}], "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "CVE Reserved"}, {"lang": "en", "time": "2026-08-10T10:32:53.000Z", "value": "Public Disclosure"}], "datePublic": "2026-08-10T10:32:53.000Z", "references": [{"url": "https://www.bludit.com", "name": "Vendor", "tags": ["third-party-advisory"]}, {"url": "https://github.com/bludit/bludit", "name": "Product", "tags": ["third-party-advisory"]}, {"url": "https://github.com/bludit/bludit/blob/dev/bl-kernel/ajax/logo-upload.php", "name": "Vulnerable File", "tags": ["technical-description"]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.", "supportingMedia": [{"type": "text/html", "value": "<p>A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:47:53.052Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72576", "state": "PUBLISHED", "dateUpdated": "2026-08-10T13:11:31.584Z", "dateReserved": "2026-08-10T10:32:53.854Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-10T10:41:03.564Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Bludit", "vendor": "Bludit", "versions": [{"status": "affected", "version": "4.0.0-beta", "versionType": "semver"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado en Bludit 4.0.0-beta permite a un usuario autenticado con bajos privilegios (rol de Autor) inyectar JavaScript arbitrario al subir un archivo SVG manipulado como el logo del sitio. Una etiqueta de script almacenada en el SVG se ejecuta en el navegador de cualquier usuario que cargue el logo."}], "id": "CVE-2026-72576", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72576", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-10T13:11:17.554196Z", "version": "2.0.3"}}]}, "published": "2026-08-10T11:17:30.407", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/bludit/bludit"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/bludit/bludit/blob/dev/bl-kernel/ajax/logo-upload.php"}, {"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://www.bludit.com"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.0-beta"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Bludit", "source": "cna", "vendor": "Bludit"}, "product": "bludit", "vendor": "bludit"}], "created": "2026-08-10T12:30:06.906089+00:00", "updated": "2026-08-10T20:00:04.000113+00:00", "vendors": ["bludit", "bludit$PRODUCT$bludit"]}