PT-2026-1068 · Pluxml · Pluxml

V3Ged4G · Published 2026-01-02 · Updated 2026-02-27 · CVE-2025-15438

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PluXml versions prior to 5.8.23

Description A flaw exists in PluXml that could allow for remote code execution. The issue is located in the FileCookieJar:: destruct function within the core/admin/medias.php file of the Media Management Module. Manipulation of the File argument can lead to deserialization. The exploit has been publicly disclosed.

Recommendations Update to PluXml version 5.8.23 or later.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-15438

Affected Products

Pluxml

References · 12

• 🔥 https://note-hxlab.wetolink.com/share/9SJUnaDcJuqz · Exploit
• https://cve.org/CVERecord?id=CVE-2025-15438 · Security Note
• https://ubuntu.com/security/CVE-2025-15438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15438 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15438 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-15438 · Vendor Advisory
• https://t.me/CVEtracker/41231 · Telegram Post
• https://t.me/cveNotify/153413 · Telegram Post
• https://vuldb.com/?id.339383 · Note
• https://twitter.com/CVEnew/status/2007103445967257820 · Twitter Post
• https://vuldb.com/?submit.713989 · Note
• https://vuldb.com/?ctiid.339383 · Note