PT-2026-26881 · Pbootcms · Pbootcms

Zmjjkk · Publicado 2026-03-21 · Atualizado 2026-03-21 · CVE-2026-4509

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.13

Description A security flaw exists in PbootCMS up to version 3.2.12 related to incomplete blacklist handling within the File Upload component. The issue resides in the file core/function/file.php and involves manipulation of the black argument. This allows for remote attacks. The exploit has been publicly released.

Recommendations Update PbootCMS to version 3.2.13 or later.

Exploit

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-183

CWE-184

Identificadores relacionados

CVE-2026-4509

Produtos afetados

Pbootcms

Referências · 7

• 🔥 https://github.com/zzj-create/cvetest/blob/main/VULN-04_DANGEROUS_FILE_UPLOAD_REPORT_EN.md · Exploit
• https://vuldb.com/?ctiid.352075 · Nota
• https://vuldb.com/?id.352075 · Nota
• https://twitter.com/CVEnew/status/2035262083097313518 · Publicação no Twitter
• https://vuldb.com/?submit.773901 · Nota
• https://twitter.com/cyberbivash/status/2035250108497797305 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4509 · Nota de Segurança