What is the CVSS score of CVE-2026-54416?

CVE-2026-54416 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Pluck CMS are affected by CVE-2026-54416?

Pluck CMS versions through 4.7.21 allow authenticated administrators to execute arbitrary code on PHP 8.x servers through a file upload bypass, with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-54416?

Within 24 hours, audit and restrict all administrator file upload permissions, verify no unauthorized uploads exist in recent logs, and disable upload features if not actively required. Within 7 days, conduct forensic analysis of all upload directories for suspicious .php8 files and review administrator activity logs for anomalies. Within 30 days, contact Pluck CMS for patch availability; if no patch is released, implement network-level access controls to block .php8 file uploads and evaluate alternative CMS platforms with stronger security posture.

Pluck CMS CVE-2026-54416

EUVD-2026-53192 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-08-05 TuranSec

GHSA-fvwx-9qcr-crph

File Upload RCE PHP Pluck Cms

7.2

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin credentials required (PR:H); upload is via web interface (AV:N); no complexity beyond authentication (AC:L); full host impact once executed.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 07:52 vuln.today

CVE Published

Aug 05, 2026 - 06:58 cve.org

HIGH 7.2

DescriptionCVE.org

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename. The blacklist omits the '.php8' extension. An authenticated administrator can upload a file named e.g. shell.php8, which is stored unmodified and, on servers running PHP 8.x, is executed as PHP by the web server, resulting in remote code execution.

AnalysisAI

Remote code execution in Pluck CMS through 4.7.21 is achievable by any authenticated administrator who exploits a gap in the file upload blacklist: the extension '.php8' is absent from the hardcoded deny-list in data/inc/files.php, allowing a crafted file to be stored and subsequently executed as PHP on servers running PHP 8.x. Reported by TuranSec, this CWE-434 flaw carries a CVSS 7.2 (PR:H), meaning exploitation is constrained to admin-level accounts but delivers full confidentiality, integrity, and availability impact once triggered. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the bypass is trivially reproducible from the CVE description by any administrator with upload access.

Technical ContextAI

Pluck CMS (CPE: cpe:2.3:a:pluck-cms:pluck_cms:*:*:*:*:*:*:*:*) implements file upload safety exclusively via a hardcoded extension blacklist defined in data/inc/files.php. The blacklist checks the last 4-5 characters of the uploaded filename against a fixed set: .php, php3, php4, php5, php6, php7, phtml, .phtm, .pht, .ph3, .ph4, .ph5, .asp, .cgi, .phar. This deny-list strategy is inherently brittle under CWE-434 (Unrestricted Upload of File with Dangerous Type) - any extension not explicitly enumerated passes validation unchecked. PHP 8.x introduced the '.php8' extension as a recognized PHP handler mapping, but the Pluck blacklist was never updated to include it. Because the uploaded file is stored unmodified on disk and the web server's MIME/handler configuration maps .php8 to the PHP 8 interpreter, the file executes with full web server privileges when requested. A whitelist-based approach (permitting only safe, explicitly known extensions) would eliminate this entire vulnerability class.

RemediationAI

No vendor-released patched version has been identified in the provided references - the only reference points to the upstream GitHub repository (https://github.com/pluck-cms/pluck) without a specific advisory, commit, or tagged fix release. Administrators should monitor the Pluck CMS GitHub repository for a patch addressing this omission. As an immediate compensating control, administrators with filesystem access can manually add '.php8' to the extension blacklist in data/inc/files.php; note this is a brittle workaround that remains vulnerable to any future PHP extensions not yet enumerated (e.g., hypothetical .php9). A stronger mitigation is to reconfigure the blacklist logic to a strict whitelist of permitted extensions (e.g., jpg, png, gif, pdf, txt, zip) and reject all others - this eliminates the entire blacklist-bypass vulnerability class at the cost of restricting what file types administrators can upload. Additionally, web server configuration can be modified to prevent execution of any scripts within the CMS upload directory (using Apache's Options -ExecCGI, or nginx's fastcgi_param restrictions on the uploads path), which breaks the execution step even if a malicious file is stored.