CVE-2026-54416

7.2 HIGHpublic exploit available

Published 2026-08-05 · Updated 2026-08-10

AI risk analysis

Summary: The flaw allows attackers to upload executable PHP files via a restricted but incomplete blacklist in file names, potentially leading to remote code execution.
Exploitability: Exploitation requires uploading a file with a filename ending in one of the blacklisted extensions, making it moderately difficult but feasible for an attacker.
Blast radius: If exploited, this could result in unauthorized access and control over the affected Pluck CMS instance, impacting site functionality and data integrity.
Prioritized remediation: Update to the latest version of Pluck CMS (4.7.21 or later) which includes improved file upload security measures.

rceuploadweb

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Public exploit & PoC references

https://github.com/pluck-cms/pluck

All references

https://github.com/pluck-cms/pluck

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.