CVE-2026-54416 in Pluck
Summary
by MITRE • 08/05/2026
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename. The blacklist omits the '.php8' extension. An authenticated administrator can upload a file named e.g. shell.php8, which is stored unmodified and, on servers running PHP 8.x, is executed as PHP by the web server, resulting in remote code execution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in Pluck CMS versions through 4.7.21 represents a critical security flaw in the file upload validation mechanism within its admin file-management feature. This issue stems from an inadequate whitelist-based approach that relies on a fixed blacklist of file extensions to prevent dangerous uploads. The implementation in data/inc/files.php maintains a restrictive list containing various PHP and scripting extensions including '.php', 'php3', 'php4', 'php5', 'php6', 'php7', 'phtml', and several variants with different extensions such as '.phtm', '.pht', '.ph3', '.ph4', '.ph5', '.asp', '.cgi', and '.phar'. However, this validation mechanism contains a significant oversight that creates an exploitable gap in the security posture. The blacklist validation operates by examining only the last 4-5 characters of uploaded filenames, which introduces a fundamental weakness in the protection scheme.
The technical flaw manifests when an authenticated administrator uploads a file with the extension '.php8'. This specific extension is deliberately omitted from the blacklist, creating a bypass opportunity for malicious actors who understand the server configuration. When such a file is uploaded to the system, it is stored unmodified without any additional validation or sanitization by the CMS. The vulnerability becomes particularly dangerous on servers configured to run PHP 8.x, where files with the '.php8' extension are interpreted and executed as PHP code by the web server. This execution chain transforms what should be a simple file upload restriction into a potential remote code execution vector that can be leveraged by attackers to gain complete control over the affected system.
The operational impact of this vulnerability extends beyond immediate code execution capabilities, as it fundamentally undermines the security model of the CMS administration interface. An attacker who has obtained administrative credentials can exploit this flaw to upload malicious PHP payloads that execute with the privileges of the web server process. This creates a persistent threat vector that can be used for data exfiltration, system compromise, lateral movement within network environments, and establishment of backdoor access. The vulnerability affects organizations using Pluck CMS versions through 4.7.21, potentially exposing them to unauthorized access and malicious activities without detection. The impact is particularly severe because it requires only administrative authentication, which is typically a higher privilege level than what standard users possess, making the attack surface more contained but also more damaging when successful.
Mitigation strategies for this vulnerability should prioritize immediate remediation through version updates to Pluck CMS 4.7.22 or later, which addresses the missing extension in the blacklist validation. Organizations should implement additional security measures including enhanced file validation that checks against a comprehensive whitelist of allowed extensions rather than relying on blacklisting approaches. Network-based protections such as web application firewalls and content filtering systems can provide defense-in-depth layers to detect and block suspicious file upload attempts. Administrative best practices include implementing strict access controls, monitoring file upload activities, and conducting regular security audits of CMS installations. The vulnerability aligns with CWE-434 which addresses insecure file upload vulnerabilities, and represents a technique commonly associated with attack vectors in the ATT&CK framework under the category of Execution through web shells or malicious code deployment. Security teams should also consider implementing automated scanning tools to identify and remediate similar issues across other CMS platforms and applications within their environments.