CVE-2026-4509

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4509", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-20T14:25:50.786Z", "datePublished": "2026-03-21T06:02:10.118Z", "dateUpdated": "2026-03-24T14:04:06.713Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-21T06:02:10.118Z"}, "title": "PbootCMS File Upload file.php incomplete blacklist", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-184", "lang": "en", "description": "Incomplete Blacklist"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-183", "lang": "en", "description": "Permissive List of Allowed Inputs"}]}], "affected": [{"vendor": "n/a", "product": "PbootCMS", "versions": [{"version": "3.2.0", "status": "affected"}, {"version": "3.2.1", "status": "affected"}, {"version": "3.2.2", "status": "affected"}, {"version": "3.2.3", "status": "affected"}, {"version": "3.2.4", "status": "affected"}, {"version": "3.2.5", "status": "affected"}, {"version": "3.2.6", "status": "affected"}, {"version": "3.2.7", "status": "affected"}, {"version": "3.2.8", "status": "affected"}, {"version": "3.2.9", "status": "affected"}, {"version": "3.2.10", "status": "affected"}, {"version": "3.2.11", "status": "affected"}, {"version": "3.2.12", "status": "affected"}], "cpes": ["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"], "modules": ["File Upload"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in PbootCMS up to 3.2.12. This affects an unknown function of the file core/function/file.php of the component File Upload. The manipulation of the argument black results in incomplete blacklist. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-20T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-20T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-20T15:31:04.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "zmjjkk (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.352075", "name": "VDB-352075 | PbootCMS File Upload file.php incomplete blacklist", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.352075", "name": "VDB-352075 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.773901", "name": "Submit #773901 | \u7ff1\u4e91\u79d1\u6280 PbootCMS 3.2.12 Incomplete Identification of Uploaded File Variables", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zzj-create/cvetest/blob/main/VULN-04_DANGEROUS_FILE_UPLOAD_REPORT_EN.md", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T14:03:02.207007Z", "id": "CVE-2026-4509", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:04:06.713Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4509", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T14:03:02.207007Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T14:04:00.413Z"}}], "cna": {"title": "PbootCMS File Upload file.php incomplete blacklist", "credits": [{"lang": "en", "type": "reporter", "value": "zmjjkk (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["File Upload"], "product": "PbootCMS", "versions": [{"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "3.2.5"}, {"status": "affected", "version": "3.2.6"}, {"status": "affected", "version": "3.2.7"}, {"status": "affected", "version": "3.2.8"}, {"status": "affected", "version": "3.2.9"}, {"status": "affected", "version": "3.2.10"}, {"status": "affected", "version": "3.2.11"}, {"status": "affected", "version": "3.2.12"}]}], "timeline": [{"lang": "en", "time": "2026-03-20T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-20T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-20T15:31:04.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.352075", "name": "VDB-352075 | PbootCMS File Upload file.php incomplete blacklist", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.352075", "name": "VDB-352075 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.773901", "name": "Submit #773901 | \u7ff1\u4e91\u79d1\u6280 PbootCMS 3.2.12 Incomplete Identification of Uploaded File Variables", "tags": ["third-party-advisory"]}, {"url": "https://github.com/zzj-create/cvetest/blob/main/VULN-04_DANGEROUS_FILE_UPLOAD_REPORT_EN.md", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in PbootCMS up to 3.2.12. This affects an unknown function of the file core/function/file.php of the component File Upload. The manipulation of the argument black results in incomplete blacklist. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-184", "description": "Incomplete Blacklist"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-183", "description": "Permissive List of Allowed Inputs"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-21T06:02:10.118Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4509", "state": "PUBLISHED", "dateUpdated": "2026-03-24T14:04:06.713Z", "dateReserved": "2026-03-20T14:25:50.786Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-21T06:02:10.118Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:pbootcms:pbootcms:*:*:*:*:*:*:*:*"], "modules": ["File Upload"], "product": "PbootCMS", "vendor": "n/a", "versions": [{"status": "affected", "version": "3.2.0"}, {"status": "affected", "version": "3.2.1"}, {"status": "affected", "version": "3.2.2"}, {"status": "affected", "version": "3.2.3"}, {"status": "affected", "version": "3.2.4"}, {"status": "affected", "version": "3.2.5"}, {"status": "affected", "version": "3.2.6"}, {"status": "affected", "version": "3.2.7"}, {"status": "affected", "version": "3.2.8"}, {"status": "affected", "version": "3.2.9"}, {"status": "affected", "version": "3.2.10"}, {"status": "affected", "version": "3.2.11"}, {"status": "affected", "version": "3.2.12"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in PbootCMS up to 3.2.12. This affects an unknown function of the file core/function/file.php of the component File Upload. The manipulation of the argument black results in incomplete blacklist. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en PbootCMS hasta la versi\u00f3n 3.2.12. Esto afecta una funci\u00f3n desconocida del archivo core/function/file.php del componente Carga de Archivos. La manipulaci\u00f3n del argumento black resulta en una lista negra incompleta. El ataque puede ser lanzado remotamente. El exploit ha sido publicado y puede ser utilizado para ataques."}], "id": "CVE-2026-4509", "lastModified": "2026-06-17T10:56:43.680", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4509", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T14:03:02.207007Z", "version": "2.0.3"}}]}, "published": "2026-03-21T06:16:14.160", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/zzj-create/cvetest/blob/main/VULN-04_DANGEROUS_FILE_UPLOAD_REPORT_EN.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.352075"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.352075"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.773901"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-183"}, {"lang": "en", "value": "CWE-184"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.2.12"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PbootCMS", "source": "cna", "vendor": "n/a"}, "product": "pbootcms", "vendor": "pbootcms"}], "analysis": {"en": {"generated_at": "2026-03-21T07:09:03.207106+00:00", "value": {"mitigation_remediation": ["Update PbootCMS to the latest released version where the file upload blacklist issue is resolved", "If an immediate upgrade is not possible, restrict the web server so that uploaded files cannot be executed by setting restrictive permissions and disabling script execution in the upload directory", "Verify and enhance the server\u2011side validation of the black parameter to accept only known safe file extensions", "Monitor web server logs for abnormal upload attempts and investigate suspicious activity", "Consider deploying a Web Application Firewall that blocks dangerous file uploads and enforces strict content type checks"], "summary": {"action": "Patch Now", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of PbootCMS that are version 3.2.12 or earlier are affected. The CNA vendor/product list specifies only PbootCMS, and no more granular version data is available beyond the stated maximum release.", "description_and_impact": "The vulnerability lies in the File Upload component of PbootCMS up to version 3.2.12, where manipulation of the black argument bypasses a file type blacklist. This flaw enables an attacker to upload files that may be executed by the web application, potentially leading to remote code execution and compromising system integrity.", "risk_and_exploitability": "The CVSS base score of 5.3 indicates moderate risk. EPSS data is unavailable and the flaw is not listed in the CISA KEV catalog, suggesting it may not yet be widely exploited, yet an exploit has been released publicly and can be launched remotely. The flaw is classified as CWE\u2011183 and CWE\u2011184, pointing to incomplete validation and improper input handling."}}}}, "created": "2026-03-23T09:49:41.733930+00:00", "updated": "2026-03-25T14:41:19.895940+00:00", "vendors": ["pbootcms", "pbootcms$PRODUCT$pbootcms"]}