Bludit Stored Cross-Site Scripting Vulnerability in Image Upload Functionality

A stored cross-site scripting vulnerability has been identified in Bludit's image upload feature. This issue affects all versions of Bludit up to and including 3.18.2. Authenticated attackers with content upload privileges, such as Authors, Editors, or Administrators, can exploit this vulnerability by uploading SVG files containing malicious JavaScript. The malicious payload is executed when a victim accesses the URL of the uploaded resource, which is available without authentication.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded malicious scripts are executed in the context of the user viewing the resource.