CyberRota Analysis
AI-GeneratedA stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows low-privileged authenticated users to upload a malicious SVG file as a site logo, leading to arbitrary JavaScript execution in the browsers of users who view the logo. This issue arises from improper handling of SVG files during the upload process, as the system fails to sanitize or transform the uploaded content. Organizations using Bludit should prioritize patching this vulnerability to protect against potential exploitation and unauthorized script execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.