CVE-2026-50869 Details

A directory traversal vulnerability has been identified in Bludit version 3.19.0, specifically within the api/plugin.php component. This issue allows authenticated administrators to exploit the file upload feature by including path traversal sequences in the multipart filename. As a result, files can be written outside the designated upload directory. The vulnerability arises because the upload handler does not properly sanitize the filename before it is processed, enabling attackers to manipulate the file path and potentially execute malicious scripts or disrupt server operations.