CVE-2026-54416
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php, checked against the last 4-5 characters of the filename.
Risk Assessment
The blacklist-based restriction and filename-ending check can be bypassed, potentially allowing an attacker to upload a malicious executable file to the server.
Recommendation
Update Pluck CMS to the latest version if a patch is available. Additionally, consider implementing extra security measures such as content validation and restricting upload directory permissions.
Other vulnerabilities in Pluck CMS
See all- CVE-2026-70376Critical
Pluck CMS's admin panel relies solely on a Referer-header comparison for CSRF protection, with no per-request anti-CSRF token. This allows attackers to potentially perform unauthorized admin actions if they can bypass the Referer check.
- CVE-2014-8708Critical
Pluck CMS version 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
- CVE-2026-16205Low
A cross-site scripting vulnerability has been found in Pluck CMS up to version 4.7.21 in the Albums module. The htmlspecialchars_decode function in data/modules/albums/albums.admin.php mishandles the Info argument, allowing remote injection of malicious scripts. The exploit is public, and the project has not responded to the report.
- CVE-2025-46099High
In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.
Original NVD description (English source)
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.