What is GHSA-9r27-c92g-8g7q?

GHSA-9r27-c92g-8g7q is a security advisory published by GitHub Security Advisories with Critical severity. Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST ...

Which CVE IDs does GHSA-9r27-c92g-8g7q cover?

GHSA-9r27-c92g-8g7q covers the following CVE IDs: CVE-2026-38329. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9r27-c92g-8g7q?

GHSA-9r27-c92g-8g7q has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-9r27-c92g-8g7qCriticalCVSS 9.8

Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST ...

Vendor

GitHub Security Advisories

Published

June 15, 2026

Last Modified

June 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-38329 →

📋 Description

Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-38329
https://gist.github.com/Ki1ro0133/8bd14bd4fc6fab81c907d838a7aeee55
https://github.com/advisories/GHSA-9r27-c92g-8g7q