CVE-2026-54416

Name of the Vulnerable Software and Affected Versions Pluck CMS versions prior to 4.7.22

Description The admin file-management feature fails to properly restrict dangerous file uploads. The system uses a fixed blacklist in data/inc/files.php that checks the last 4-5 characters of a filename but omits the .php8 extension. An authenticated administrator can upload a file with the .php8 extension, which is stored unmodified. On servers running PHP 8.x, the web server executes this file as PHP, leading to remote code execution.

Recommendations Update Pluck CMS to version 4.7.22 or later. As a temporary mitigation, restrict access to the admin file-management feature or ensure the server is not running PHP 8.x.