CVE-2026-72576: Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-10-24
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.

Affected products

Bludit: 4.0.0-beta

References

https://github.com/bludit/bludit
https://github.com/bludit/bludit/blob/dev/bl-kernel/ajax/logo-upload.php
https://www.bludit.com

Get alerted when CVE-2026-72576 or the next vulnerability affects your stack