CVE-2026-54416

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54416", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-06-13T16:39:46.122Z", "datePublished": "2026-08-05T06:58:23.512Z", "dateUpdated": "2026-08-10T11:44:06.635Z"}, "containers": {"cna": {"title": "Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist", "descriptions": [{"lang": "en", "value": "Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "affected": [{"vendor": "pluck-cms", "product": "Pluck CMS", "programFiles": ["data/inc/files.php"], "versions": [{"version": "0", "lessThanOrEqual": "4.7.21", "versionType": "custom", "status": "affected"}], "defaultStatus": "unknown"}], "metrics": [{"other": {"type": "CVSS_3.1_severity", "content": {"value": "HIGH"}}}, {"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://github.com/pluck-cms/pluck", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Alijonov Alisher", "type": "finder"}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:06.635Z"}, "source": {"discovery": "EXTERNAL"}, "datePublic": "2026-08-05T06:58:23.512Z"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-05T13:26:25.540119Z", "id": "CVE-2026-54416", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:31:13.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54416", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T13:26:25.540119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-05T13:31:02.690Z"}}], "cna": {"title": "Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Alijonov Alisher"}], "metrics": [{"other": {"type": "CVSS_3.1_severity", "content": {"value": "HIGH"}}}, {"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pluck-cms", "product": "Pluck CMS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "4.7.21"}], "programFiles": ["data/inc/files.php"], "defaultStatus": "unknown"}], "datePublic": "2026-08-05T06:58:23.512Z", "references": [{"url": "https://github.com/pluck-cms/pluck", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.", "supportingMedia": [{"type": "text/html", "value": "<p>Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-10T11:44:06.635Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54416", "state": "PUBLISHED", "dateUpdated": "2026-08-10T11:44:06.635Z", "dateReserved": "2026-06-13T16:39:46.122Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-05T06:58:23.512Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Pluck CMS", "programFiles": ["data/inc/files.php"], "vendor": "pluck-cms", "versions": [{"lessThanOrEqual": "4.7.21", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename."}, {"lang": "es", "value": "Pluck CMS hasta la versi\u00f3n 4.7.21 restringe la carga de archivos peligrosos en su funci\u00f3n de gesti\u00f3n de archivos de administrador utilizando una lista negra fija en data/inc/files.php (\u2019.php\u2019,\u2019php3\u2019,\u2019php4\u2019,\u2019php5\u2019,\u2019php6\u2019,\u2019php7\u2019,\u2019phtml\u2019,\u2019.phtm\u2019,\u2019.pht\u2019,\u2019.ph3\u2019,\u2019.ph4\u2019,\u2019.ph5\u2019,\u2019.asp\u2019,\u2019.cgi\u2019,\u2019.phar\u2019), comprobada contra los \u00faltimos 4-5 caracteres del nombre de archivo. La lista negra omite la extensi\u00f3n \u2019.php8\u2019. Un administrador autenticado puede cargar un archivo llamado, por ejemplo, shell.php8, que se almacena sin modificar y, en servidores que ejecutan PHP 8.x, es ejecutado como PHP por el servidor web, lo que resulta en ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2026-54416", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54416", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-05T13:26:25.540119Z", "version": "2.0.3"}}]}, "published": "2026-08-05T08:16:33.637", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/pluck-cms/pluck"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.7.21]"}}], "enrichment": {"confidence": 97.0, "confidence_source": "matching", "scores": [{"score": 97.0, "source": "matching"}]}, "original": {"product": "Pluck CMS", "source": "cna", "vendor": "pluck-cms"}, "product": "pluckcms", "vendor": "pluck-cms"}], "created": "2026-08-05T08:30:04.507233+00:00", "updated": "2026-08-10T22:15:03.871699+00:00", "vendors": ["pluck-cms", "pluck-cms$PRODUCT$pluckcms"]}