Arbitrary file upload in Pluck-cms Pluck Cms
CVE-2026-54416
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cg…
Vulnerability class: Unrestricted File Upload
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Pluck-cms Pluck Cms — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-54416?
- CVE-2026-54416 is a high-severity vulnerability in Pluck-cms Pluck Cms, classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 7.2/10. Published 2026-08-05.
- How severe is CVE-2026-54416?
- High severity. CVSS v3 base score is 7.2 out of 10.