CVE-2026-72576

The CVSS 5.4 rating for CVE-2026-72576 is analytically inadequate and masks a critical architectural failure. Bludit 4.0.0-beta shipped an SVG upload feature for site logos without any content sanitization, treating a known-injection vector as a benign file type. The vulnerability isn't the XSS itself—stored XSS via SVG is a documented class—but the mechanism that enabled it: Bludit validated file headers or extension without parsing and stripping executable elements from the SVG markup. This conflates 'this is an image file' with 'this image is safe to render as HTML,' and it's a failure pattern repeated across CMS platforms for two decades. The privilege context deserves scrutiny. The Author role is presented as low-privileged, but Authors are permitted to upload content as a core function. This vulnerability didn't require bypassing access controls—it exploited intended functionality. That distinction matters for remediation: the fix isn't just sanitizing SVG; it's rethinking what file types the Author role should be permitted to upload, and whether logo uploads should be restricted to admin-only paths rather than user-accessible ones. More critically, the CVSS scoring obscures the actual blast radius. A stored XSS in a comment field has constrained blast radius—only users who view comments are affected. A stored XSS in the site logo executes silently on every page load for every visitor, including admins with elevated sessions. The Author didn't need to escalate privileges because the logo already executes at the highest possible context—it's embedded in every page including admin pages, has access to all cookies, and can read all page content including CSRF tokens. The attack doesn't need to be sophisticated because the execution context is so broad. 5.4 is defensible for XSS in a sandboxed context; it's indefensible for XSS that lives in the application chrome. The correct remediation requires server-side SVG schema validation that parses the XML and strips script elements, event handlers, and SMIL animations—not merely MIME-type verification. Serving uploaded SVGs with Content-Security-Policy: default-src 'none' forces browser fallback to download rather than render, but this alone is insufficient because the logo context means injected scripts execute with full access to Bludit's session cookies and CSRF tokens. The structural fix should be admin-only flagging on logo uploads regardless of the sanitization approach—the principle of least privilege means content creation roles shouldn't have files rendered in global chrome contexts without explicit justification.

Reviewed through automated stages and approved by a human before publication.