{"id":"CVE-2026-54416","published":"2026-08-05T08:16:33.637","lastModified":"2026-08-10T12:17:17.840","description":"Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.","cvssScore":7.2,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pluck-cms/pluck","tags":[]}],"exploitRefs":[{"url":"https://github.com/pluck-cms/pluck","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to upload executable PHP files via a restricted but incomplete blacklist in file names, potentially leading to remote code execution.","exploitability":"Exploitation requires uploading a file with a filename ending in one of the blacklisted extensions, making it moderately difficult but feasible for an attacker.","blast_radius":"If exploited, this could result in unauthorized access and control over the affected Pluck CMS instance, impacting site functionality and data integrity.","remediation":"Update to the latest version of Pluck CMS (4.7.21 or later) which includes improved file upload security measures.","tags":["rce","upload","web"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T07:02:35.637Z"}}