CVE-2019-12548: Bludit

High severity, CVSS 8.8. EPSS: 3% chance of exploitation in the next 30 days.

Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.

Affected products

• Bludit Bludit: before 3.9.0 (fixed in 3.9.0)

Published 2019-06-03. Last modified 2026-06-17.