LoginSign Up
← Back to all sparks
B

Bludit

MARKETING
Velocity0.0

Flat-file CMS for building fast websites without a database

www.bludit.com ↗

A flat-file CMS with a long CVE history just wired its API up for MCP.

flat-file-cmsmcpsecurity-fixesapiplugin-hooks
◆Current state
Bludit ships every few weeks, and almost every release carries a security fix: an authentication bypass and arbitrary file upload in 3.18.4, an authenticated RCE via file upload plus .htaccess bypass in 3.20.0, a path traversal in the API files endpoint in 3.21.0, and session invalidation for disabled users in 3.22.0. Around that, the work is editor and dashboard maintenance, theme additions and a plugin hook for injecting editor toolbar buttons.
◆Where it's heading
Two threads run in parallel. One is a sustained security cleanup, largely driven by external reports and handled release by release. The other is a quiet repositioning of the API: 3.22.0 improved it specifically to support MCP, which points a file-based CMS at agent-driven authoring. The plugin hook work in 3.20.0 fits the same pattern of opening the editor to programmatic control.
◆Prediction
Expect the MCP-facing API work to continue — the initial support arrived as API improvements rather than a documented server, which is the piece still missing.

◆Recent moves

  1. 3mo ago

    API reworked to support MCP; disabled-user sessions invalidated

    ⚡ SPARK

    A two-item release where one item changes what Bludit is for. Opening the API to MCP puts an agent-facing control path on a CMS whose recent history is mostly about closing unintended control paths, which makes the accompanying session-invalidation fix more than incidental.

    View source ↗
  2. 3mo ago

    Patch: preview token type guard

    Guards the preview token against non-string values before hash comparison, plus a version bump. A follow-up to the preview handling changed in 3.21.0.

    View source ↗
  3. 3mo ago

    Path traversal fixed in the API files endpoint

    The API endpoint that 3.22.0 later built MCP support on gets its pageKey validated against path traversal, reported externally. The rest is media manager, thumbnail and dashboard repair work.

    View source ↗
  4. 3mo ago

    Authenticated RCE via file upload fixed; editor toolbar hook added

    An authenticated remote code execution path through file upload and .htaccess bypass is closed. The editorToolbar hook, which lets plugins inject their own toolbar buttons, is the first step toward programmatic control of the editing surface.

    View source ↗
  5. 4mo ago

    Flavor Tailwind theme added; randomness and header fixes

    A minimal Tailwind blog theme plus a set of correctness fixes, including using random_int for generated text and honouring verifySSL in the stream fallback. Routine but user-visible.

    View source ↗
  6. 4mo ago

    Authentication bypass and arbitrary file upload fixed

    Two serious externally reported flaws fixed in one patch release. This is the starting point of the security cleanup that runs through every release since.

    View source ↗