CVE-2026-25101 is a critical session fixation flaw (CVSS 9.8) in Bludit, the flat file CMS. Bludit lets a session identifier be set before login and keeps the same value after login. An attacker who fixes the ID can later hijack the session. Upgrade to Bludit 3.17.2 at minimum, or the latest release.
What's affected
- Affected: Bludit versions below 3.17.2, according to CERT Polska.
- Fixed in: 3.17.2. The release notes for 3.17.2 say "Security fix for session fixation".
CERT Polska published this together with two other Bludit CVEs on 27 March 2026. One is an unrestricted upload through the API plugin, fixed in 3.18.4, and the other is stored cross site scripting through SVG upload, affecting versions up to 3.18.2. Moving to the newest release covers all three.
How to check if you're exposed
Check the version in the admin panel, or read it from the install.
grep -r "BLUDIT_VERSION" bl-kernel/boot/init.php
If the value is below 3.17.2, you are affected. Check every Bludit site you run, including old staging copies that still face the internet.
What to do now
- Upgrade Bludit to the latest release, and at least 3.17.2.
- After upgrading, log everyone out so old session identifiers stop working.
- Check admin accounts for any you do not recognize.
- Serve the admin area over HTTPS only, and keep it off the public internet if you can.
- Review the other two CVEs in the CERT Polska notice for the upload and SVG fixes.
Why it matters
Session fixation works because the application does not issue a new identifier at the moment a user logs in. An attacker who can plant a known ID in a victim's browser then waits for the victim to authenticate and reuses the same ID. The fix is to create a fresh session on login. The class is CWE-384 (Session Fixation).
The CVSS score of 9.8 comes from the NVD record, which rates it as network reachable with no privileges and no user interaction. The practical path usually needs some way to set the identifier in a victim's browser, so read the vector with that in mind.
Quick check
Is CVE-2026-25101 exploited in the wild?
The record does not mark it as a CISA Known Exploited Vulnerability, and the sources I read do not report exploitation.
Why does the CERT Polska page mention CVE-2026-25099?
The page is a combined notice for three Bludit CVEs. Its address uses the first CVE number, and this CVE is the third entry.
Sources
Last reviewed: 19 October 2026.
