PT-2026-1068 · Pluxml · Pluxml

V3Ged4G · CVE-2025-15438 · Published 2026-01-02 · Updated 2026-02-27

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PluXml versions prior to 5.8.23

Description A flaw exists in PluXml that could allow for remote code execution. The issue is located in the FileCookieJar:: destruct function within the core/admin/medias.php file of the Media Management Module. Manipulation of the File argument can lead to deserialization. The exploit has been publicly disclosed.

Recommendations Update to PluXml version 5.8.23 or later.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-20

CWE-502

Related Identifiers

CVE-2025-15438

Affected Products

Pluxml

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15438.json · Exploit
• 🔥 https://note-hxlab.wetolink.com/share/9SJUnaDcJuqz · Exploit
• https://cve.org/CVERecord?id=CVE-2025-15438 · Security Note
• https://osv.dev/vulnerability/CVE-2025-15438 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-15438 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-15438 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15438 · Security Note
• https://vuldb.com/?id.339383 · Note
• https://vuldb.com/?submit.713989 · Note
• https://t.me/cveNotify/153413 · Telegram Post
• https://t.me/CVEtracker/41231 · Telegram Post
• https://vuldb.com/?ctiid.339383 · Note
• https://twitter.com/CVEnew/status/2007103445967257820 · Twitter Post