Remote Code Execution Vulnerability in Pluck CMS by Pluck CMS

CVE-2026-54416

What is CVE-2026-54416?

Pluck CMS versions up to 4.7.21 are susceptible to a remote code execution vulnerability due to a flaw in its file upload management. The application employs a fixed blacklist to restrict certain file types; however, this list does not include the '.php8' extension. Consequently, if an authenticated administrator uploads a file named 'shell.php8', it can be stored without modification and executed by the web server on systems running PHP 8.x. This severe oversight can allow attackers to run arbitrary code remotely, compromising the security of the application.

References