CVE-2026-27742 Details

A stored cross-site scripting vulnerability has been identified in Bludit version 3.16.2. This issue arises in the post content feature, where the application only applies client-side sanitation of input but fails to implement equivalent sanitation on the server side. As a result, an authenticated user can inject arbitrary JavaScript into the content field of a post. This injected script is stored and later rendered to other users without proper output encoding. When the content is viewed, the script executes in the context of the victim's browser, potentially leading to session hijacking, credential theft, content manipulation, or other actions within the user's privileges.