CVE-2026-38329

Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.

• CWE-862

• https://gist.github.com/Ki1ro0133/8bd14bd4fc6fab81c907d838a7aeee55
• https://gist.github.com/Ki1ro0133/8bd14bd4fc6fab81c907d838a7aeee55

Published

Jun 15, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3826IFTOP developed by WellChoose has a Local File Inclusion vul…9.8
• CVE-2026-3828Some Hikvision switch products (discontinued since December …7.2
• CVE-2026-3829The WP Encryption – One Click Free SSL Certificate & SSL / H…5.4
• CVE-2026-3830The Product Filter for WooCommerce by WBW WordPress plugin b…8.6
• CVE-2026-3831The Database for Contact Form 7, WPforms, Elementor forms pl…4.3
• CVE-2026-3832A flaw was found in gnutls. A remote attacker could exploit …3.7
• CVE-2026-3833A flaw was found in gnutls. This vulnerability occurs becaus…7.4
• CVE-2026-38332TinyEXIF before 1.1.0 has a heap-based buffer over-read in E…2.9
• CVE-2026-38343An integer overflow in the libavfilter/vf_scale.c component …6.5
• CVE-2026-38344A NULL pointer dereference in the get_min_buffer_size functi…7.5
• CVE-2026-38345A Division-by-Zero vulnerability in the ff_sws_init_single_c…6.5
• CVE-2026-38346An integer overflow in the yuv2planeX_8_c() function (libsws…7.5