Executive brief
Pluck CMS, a lightweight content management system, contains a security flaw in its Albums module. An authorized user with administrative access can upload malicious files to the server. This allows the attacker to run arbitrary commands on the website's hosting server, potentially leading to a complete takeover of the site and access to sensitive data.
Technical details
An authenticated remote code execution (RCE) vulnerability exists in Pluck CMS 4.7.20-dev due to unrestricted file upload capabilities in the Albums module. The root cause is a failure to properly validate file types and extensions during the upload process, combined with flawed routing logic in 'albums.site.php' that allows direct access to files within the 'data/modules/albums/' directory. An attacker with administrative credentials can upload a PHP shell (potentially disguised as an image) and then invoke it via a direct HTTP GET request. Successful exploitation allows for arbitrary PHP code execution and full server compromise within the context of the web server user. Remediation involves implementing strict MIME type validation and preventing direct execution of files within the upload directory.
Affected products
- Pluck Pluck CMS 4.7.20-dev
Timeline
- 2025-07-23: advisory: NVD publication date