CVE-2026-38329 [CRITICAL] – Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. Th

Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server.