---
id: CVE-2023-53907
title: Bludit < 3.13.0 Authenticated Arbitrary File Download via Backup Plugin
summary: >-
  Bludit versions before 3.13.0 contain an authenticated file download
  vulnerability in the Backup Plugin that allows logged-in users to access
  arbitrary files. Attackers can exploit the plugin's download functionality by
  manipulating file…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: Bludit
product: Backup Plugin
affected:
  - backup_plugin < 3.13.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-12-18T14:51:30.501734Z'
published: '2025-12-17'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:02.347Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53907'
references:
  - url: 'https://www.exploit-db.com/exploits/51541'
    label: ExploitDB-51541
  - url: 'https://www.bludit.com'
    label: Official Product Webpage
  - url: >-
      https://www.vulncheck.com/advisories/bludit-authenticated-arbitrary-file-download-via-backup-plugin
    label: >-
      VulnCheck Advisory: Bludit < 3.13.0 Authenticated Arbitrary File Download
      via Backup Plugin
tags:
  - cve.org
epss: 0.00811
epssPercentile: 0.57166
ingestedAt: '2026-11-03T08:39:35.531Z'
---

## Overview

Bludit versions before 3.13.0 contain an authenticated file download vulnerability in the Backup Plugin that allows logged-in users to access arbitrary files. Attackers can exploit the plugin's download functionality by manipulating file path parameters to read sensitive system files through directory traversal.

## Affected

- `backup_plugin < 3.13.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.