CVE-2026-54416 Details
Description
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.
A remote code execution vulnerability exists in Pluck CMS versions through 4.7.21. The issue arises from the admin file-management feature, which employs a fixed blacklist to restrict file uploads. This blacklist, located in data/inc/files.php, fails to account for the '.php8' extension. As a result, an authenticated administrator can upload a file named 'shell.php8', which is stored without modification. On servers running PHP 8.x, the file is executed as PHP by the web server, leading to remote code execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pluck-cms/pluck | TuranSec | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Pluck CMS | <= 4.7.21 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |