PT-2025-11092 · Plenti+1 · Plenti+1

Ahmetak4N · Published 2025-02-05 · Updated 2025-03-15 · CVE-2025-26260

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Plenti versions 0.7.16 and earlier

Description: The issue allows code execution when users upload '.svelte' files with the /postLocal endpoint and define the file name as javascript codes. The server executes the uploaded file name, causing code execution. This can lead to a Denial of Service impact due to the sandboxing. If there is a vulnerability in v8go that allows escaping the sandbox, different impacts can be shown.

Recommendations: For Plenti versions 0.7.16 and earlier, as a temporary workaround, consider restricting access to the /postLocal endpoint to minimize the risk of exploitation. Avoid using the file parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-26260

GHSA-323W-6P85-26FR

GHSA-MJ4V-HP69-27X5

GO-2025-3454

GO-2025-3515

OPENSUSE-SU-2025:14893-1

Affected Products

Plenti

V8Go

References · 25

• 🔥 https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5 · Exploit
• 🔥 https://ahmetakan.com/2025/02/14/cve-2025-26260 · Exploit
• 🔥 https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260 · Exploit
• https://osv.dev/vulnerability/CVE-2025-26260 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mj4v-hp69-27x5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26260 · Security Note
• https://osv.dev/vulnerability/GO-2025-3515 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3454 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-323w-6p85-26fr · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14893-1 · Vendor Advisory
• https://github.com/plentico/plenti/releases/tag/v0.7.17 · Note
• https://github.com/plentico/plenti/commit/c3e72a9ebbc2a03f4b0f3104becbfc25e390cb8e · Note
• https://github.com/plentico/plenti · Note
• https://pkg.go.dev/vuln/GO-2025-3515 · Note
• https://suse.com/security/cve/CVE-2024-52812 · Note