CVEvulnerability
CVE-2018-11331
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-05-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-434
Description
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.
Affected configurations
• pluck-cms pluck (< 4.7.6)
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e Patch, Third Party Advisory
- https://github.com/pluck-cms/pluck/issues/58 Issue Tracking, Patch, Third Party Advisory
- https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e Patch, Third Party Advisory
- https://github.com/pluck-cms/pluck/issues/58 Issue Tracking, Patch, Third Party Advisory