CVE-2025-15438
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability was found in PluXml up to 5.8.22 in the FileCookieJar::__destruct function of core/admin/medias.php in the Media Management Module. Manipulating the File argument can lead to deserialization, and the attack can be launched remotely. The exploit has been publicly disclosed and the vendor announced a fix in version 5.8.23.
Risk Assessment
A remote attacker can leverage the publicly known exploit to perform unsafe deserialization, potentially leading to code execution or system compromise.
Recommendation
Immediately update PluXml to version 5.8.23 or later, where the patch is available.
Other vulnerabilities in PluXml
See all- CVE-2022-25020Medium
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
- CVE-2022-25018High
Pluxml version 5.8.7 was found to allow attackers to execute arbitrary code by injecting crafted PHP code into static pages.
Original NVD description (English source)
A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS