PT-2025-30156 · Pluck Cms · Pluck Cms

Published 2025-07-19 · Updated 2025-10-14 · CVE-2025-46099

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pluck CMS version 4.7.20-dev

Description Pluck CMS contains a flaw that allows an authenticated attacker to upload or create a crafted PHP file within the albums module directory. This file can then be accessed through the module routing logic in albums.site.php, potentially leading to arbitrary command execution via a GET parameter.

Recommendations Update to a newer version of Pluck CMS that addresses this issue. As a temporary workaround, restrict file upload capabilities within the albums module. Review and restrict access to the albums.site.php file to prevent unauthorized access.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-46099

Affected Products

Pluck Cms

References · 8

• 🔥 https://github.com/0xC4J/CVE-Lists/blob/main/CVE-2025-46099/CVE-2025-46099.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-46099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46099 · Security Note
• https://t.me/cveNotify/138530 · Telegram Post
• https://twitter.com/PoC_in_Github/status/1946647577186959862 · Twitter Post
• https://t.me/CVEtracker/28495 · Telegram Post
• http://pluck.com · Note
• https://twitter.com/CVEnew/status/1948024981889196292 · Twitter Post