Description

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload endpoint in bl-kernel/ajax/logo-upload.php moves the uploaded file directly to the web root via Filesystem::mv() without invoking sanitizeSVG() or transformImage(), while SVG is present in the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists. A stored script tag in the SVG executes in the browser of any user who loads the logo.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-10T11:17:30.407Z",
  "pubdate": "2026-08-10T11:17:30.407Z",
  "executiveSummary": "A stored cross-site scripting (XSS) vulnerability exists in Bludit 4.0.0-beta, affecting the logo upload functionality. The flaw enables low-privileged authenticated users assigned the Author role to inject arbitrary JavaScript payloads into the application by uploading a maliciously crafted Scalable Vector Graphics (SVG) file acting as the site logo.\nThe security impact allows malicious script execution within the context of any user's browser who subsequently loads or views the affected site logo. This compromises administrative and user sessions, potentially leading to unauthorized administrative actions, data theft, or complete site defacement depending on the privileges of the victim viewing the resource.\nExploitation requires authentication as an Author role or higher, granting access to the administrative upload endpoint. The risk implications are severe due to persistent script execution capabilities and the lack of proper input validation or sanitization on uploaded SVG files prior to deployment in the web root.",
  "technicalDetails": "The vulnerability resides within the logo upload mechanism implemented in Bludit 4.0.0-beta. Specifically, the vulnerable component is the /admin/ajax/logo-upload endpoint handled by bl-kernel/ajax/logo-upload.php. The root cause of the vulnerability stems from improper handling and insufficient validation of uploaded files that contain executable markup.\nDuring the upload process, the application accepts SVG files because SVG is explicitly included within the ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES allow-lists. However, upon receiving the file, the endpoint directly moves the uploaded SVG file into the web root using the Filesystem::mv() method without invoking necessary security sanitation functions such as sanitizeSVG() or transformImage().\nThe attack flow proceeds as follows: First, an authenticated attacker possessing the low-privileged Author role navigates to the administrative interface and prepares a crafted SVG file containing embedded malicious JavaScript enclosed within a stored script tag. Second, the attacker uploads this file via the /admin/ajax/logo-upload endpoint. Third, the application processes the upload through bl-kernel/ajax/logo-upload.php and transfers the raw, unsanitized file directly to the web root via Filesystem::mv() without executing sanitizeSVG() or transformImage(). Finally, when any unsuspecting user or administrator loads the site logo, the embedded script tag within the SVG executes directly in their browser within the application's origin context.\nAuthentication and privilege requirements include valid credentials for a low-privileged authenticated user holding the Author role. Network exposure is local to the administrative interface over standard web protocols. Post-exploitation impact includes session hijacking, arbitrary client-side action execution, and persistent stored cross-site scripting across the application environment."
}