Bludit Directory Traversal Vulnerability (CVE-2019--16113)

Bludit-3.9.2 is a lightweight CMS that only requires a LAMP environment to run. During image upload, Bludit checks the file extension but does not delete the file in time; an attacker can also achieve directory traversal by controlling the uuid parameter. For details, refer to

Vulnerable Environment

Execute the following commands to build the image and start the Bludit container

cd Docker
sudo docker build -t bludit:cve . # Build the image
sudo docker run --name bludit -p 8000:80 -d bludit:cve # Start the container, service on port 8000

Visit http://your-ip:8000 to create an account.

Exploiting this vulnerability requires registering a user who can edit blogs. You need to log in to Bludit to register a user. Assume that in the current environment the user is admin-bupt123

Vulnerability Reproduction

POC referenced from, mainly modified the image backdoor content. The attacker machine listens on port 8080, POC uploads the image backdoor to achieve RCE, reverse shell, and the attacker machine successfully obtains the shell.