Directory Traversal and Code Execution Vulnerability in Pluck-CMS by Pluck
CVE-2021-31746

9.8CRITICAL

Key Information:

Vendor

Pluck-cms

Status
Pluck
Vendor
CVE Published:
10 December 2021

What is CVE-2021-31746?

The Zip Slip vulnerability in Pluck-CMS version 4.7.15 permits attackers to exploit specially crafted zip files. This can lead to directory traversal, which exposes sensitive file paths, and may allow arbitrary code execution within the server environment. Proper validation of zip file content is essential to mitigate this risk and prevent unauthorized access.

References

https://github.com/pluck-cms/pluck/issues/100
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.