CVE-2018-1000811: Bludit content upload allows dangerous file type leading to RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution via a low-privileged upload with public exploit code and very high EPSS, though it requires an authenticated account and is not in KEV.

What it is

Bludit 3.0.0's Pages Editor content upload accepts files of dangerous types, letting a user upload a crafted PHP payload. Because uploaded content can be executed by the web server, this turns a file upload into remote command execution. The flaw is rated high (CVSS 3.0 8.8) and has public exploit references.

Impact

An attacker with a low-privileged account can upload and execute arbitrary PHP, gaining code execution in the context of the web server. That typically leads to full compromise of the Bludit instance and any data or host access the web user holds.

Attack surface

Reachable over the network through the Pages Editor upload function; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N). No authentication bypass is described, so a valid low-privileged account is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.476 probability, 98.8th percentile) and references are tagged Exploit, indicating public exploit code exists. No ransomware association is documented.

What to do

• Upgrade Bludit past 3.0.0 to a release that restricts upload file types; patch first.
• If upgrade is not possible, disable or restrict the Pages Editor upload feature and remove upload permissions from untrusted accounts.
• Enforce server-side allowlisting of uploaded file extensions and MIME types, and store uploads outside the web root.
• Configure the web server to never execute PHP from upload or content directories.
• Audit existing accounts and uploaded content for unauthorized PHP files.

Detection

• Monitor web server logs for POST requests to Pages Editor upload endpoints followed by requests to newly written PHP files.
• Alert on PHP files appearing in upload or content directories, especially with recent creation times.
• Scan the Bludit content and upload directories for files containing PHP tags or executable extensions.
• Review web server error and access logs for execution attempts against uploaded paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.