How to fix CVE-2025-15438?

Within 30 days: Identify affected systems running PluXml and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Is PHP affected by CVE-2025-15438?

Organizations using PluXml should be aware of moderate risk from CVE-2025-15438, a input validation vulnerability rated CVSS 4.7. Exploitation could compromise the security of affected deployments. Proof-of-concept code is publicly available.

CVE-2025-15438

MEDIUM

2026-01-02 [email protected]

4.7

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 27, 2026 - 03:45 vuln.today

Public exploit code

CVE Published

Jan 02, 2026 - 15:15 nvd

MEDIUM 4.7

Description

A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.

Analysis

A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. [CVSS 4.7 MEDIUM]

Technical Context

Classified as CWE-20 (Improper Input Validation). Affects Pluxml. A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.

Affected Products

Vendor: Pluxml. Product: Pluxml. Versions: up to 5.8.22..

Remediation

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +24

POC: +20

CVE-2025-15438 vulnerability details – vuln.today

Back

CVE-2025-15438

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-15438

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code