PT-2026-22331 · Unknown · Pluxml Cms

Arkadiusz Marta · Published 2026-02-27 · Updated 2026-02-27 · CVE-2026-24350

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PluXml CMS versions 5.8.21 and 5.9.0-rc7

Description PluXml CMS contains a Stored Cross-Site Scripting (XSS) issue in the file uploading functionality. An authenticated attacker can upload a malicious SVG file. Clicking the link associated with the uploaded image, or directly accessing the file, can execute the embedded payload. The vendor was notified but did not provide details about the vulnerability or vulnerable version range.

Recommendations Update to a newer version of PluXml CMS that addresses this issue. Avoid uploading SVG files from untrusted sources. As a temporary workaround, consider restricting file uploads to only trusted file types.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24350

Affected Products

Pluxml Cms

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-24350 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-24350 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24350 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-24350 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24350 · Vendor Advisory
• https://pluxml.org · Note
• https://cert.pl/posts/2026/03/CVE-2026-24350 · Note
• https://t.me/cveNotify/153457 · Telegram Post
• https://t.me/CVEtracker/45974 · Telegram Post
• https://t.me/cveNotify/153458 · Telegram Post
• https://twitter.com/CVEnew/status/2027380158487757165 · Twitter Post
• https://t.me/cveNotify/153456 · Telegram Post