PT-2026-26881 · Pbootcms · Pbootcms

Zmjjkk · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4509

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to 3.2.13

Description A security flaw exists in PbootCMS up to version 3.2.12 related to incomplete blacklist handling within the File Upload component. The issue resides in the file core/function/file.php and involves manipulation of the black argument. This allows for remote attacks. The exploit has been publicly released.

Recommendations Update PbootCMS to version 3.2.13 or later.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-183

CWE-184

Related Identifiers

CVE-2026-4509

Affected Products

Pbootcms

References · 7

• 🔥 https://github.com/zzj-create/cvetest/blob/main/VULN-04_DANGEROUS_FILE_UPLOAD_REPORT_EN.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4509 · Security Note
• https://vuldb.com/?ctiid.352075 · Note
• https://vuldb.com/?id.352075 · Note
• https://twitter.com/CVEnew/status/2035262083097313518 · Twitter Post
• https://vuldb.com/?submit.773901 · Note
• https://twitter.com/cyberbivash/status/2035250108497797305 · Twitter Post