BlueprintUE Self-Hosted Edition: Resource exhaustion vulnerability (CVE-2026-126659)

BlueprintUE Self-Hosted Edition versions prior to 4.3.5 are vulnerable to a resource exhaustion attack (CVE-2026-126659). The vulnerability exists in the HomeController::doProcessCreateBlueprint() function, where unauthenticated users can trigger the creation of anonymous blueprints. By submitting large requests with the expiration parameter set to 'never', attackers can bypass automated purge mechanisms, leading to rapid disk space consumption and a denial-of-service state for the application.

Impact

Successful exploitation results in a denial-of-service condition due to disk space exhaustion on the host server.

Recommendation

• Patch the application immediately by upgrading BlueprintUE Self-Hosted Edition to version 4.3.5 or later.
• Audit existing blueprint storage directories for an abnormally high count of files with indefinite expiration settings.