CVE-2020-18190: Bludit

Critical severity, CVSS 9.1. EPSS: 2% chance of exploitation in the next 30 days.

Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /admin/ajax/upload-profile-picture.

Affected products

• Bludit Bludit: version 3.8.1 only

Published 2020-10-02. Last modified 2026-06-17.