PT-2026-1068

CVE-2025-15438

Published

2026-01-02

Updated

2026-02-27

Description by

CVSS 3.1

7.2

High

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PluXml versions prior to 5.8.23

Description A flaw exists in PluXml that could allow for remote code execution. The issue is located in the FileCookieJar:: destruct function within the core/admin/medias.php file of the Media Management Module. Manipulation of the File argument can lead to deserialization. The exploit has been publicly disclosed.

Recommendations Update to PluXml version 5.8.23 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-502: Deserialization of Untrusted Data

Related identifiers