CVE-2026-54416

Severity CVSS v4.0:

Pending analysis

Type:

CWE-434 Unrestricted Upload of File with Dangerous Type

Publication date:

05/08/2026

Last modified:

10/08/2026

Description

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php (&#39;.php&#39;,&#39;php3&#39;,&#39;php4&#39;,&#39;php5&#39;,&#39;php6&#39;,&#39;php7&#39;,&#39;phtml&#39;,&#39;.phtm&#39;,&#39;.pht&#39;,&#39;.ph3&#39;,&#39;.ph4&#39;,&#39;.ph5&#39;,&#39;.asp&#39;,&#39;.cgi&#39;,&#39;.phar&#39;), checked against the last 4-5 characters of the filename.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 7.20 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

7.20

Severity 3.x

HIGH

References to Advisories, Solutions, and Tools

https://github.com/pluck-cms/pluck