CVE-2019-16113: Bludit image upload path traversal leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution with public exploit code and very high EPSS, though it requires an authenticated low-privileged account.

What it is

Bludit 3.9.2 lets an authenticated user upload a file named with a .jpg extension that still contains PHP code, and the upload handler in bl-kernel/ajax/upload-images.php does not stop traversal sequences. The attacker can then use that PHP to write further PHP code to a ../ pathname, achieving code execution on the server.

Impact

An attacker with a low-privileged account can write arbitrary PHP files outside the intended upload directory and execute code on the web server, giving full control of the Bludit host and its data.

Attack surface

Reached over the network through the upload-images.php AJAX endpoint; the CVSS vector shows PR:L, so a low-privileged authenticated account is required, and no user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.77962 (99.55th percentile) and multiple references are tagged Exploit, indicating public exploit code exists and exploitation is likely.

What to do

• Upgrade Bludit to a version after 3.9.2 that fixes the upload-images.php traversal and file-type handling.
• If immediate upgrade is not possible, restrict or disable the upload-images.php AJAX endpoint and block uploads containing traversal sequences or PHP content.
• Enforce server-side validation of uploaded file names and content, and store uploads outside the web root with execution disabled.
• Restrict Bludit accounts to trusted users and review permissions for low-privileged roles.
• Monitor and remove any unexpected PHP files written outside the uploads directory.

Detection

• Alert on POST requests to bl-kernel/ajax/upload-images.php with file names containing ../ or .jpg names carrying PHP content.
• Hunt for newly created PHP files in web-accessible directories outside the normal uploads path.
• Review web server logs for upload requests followed by requests to the newly written PHP files.
• Monitor file integrity in the Bludit installation and web root for unexpected changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.