CVE-2025-26260
HIGH 8.8EPSS 0.7%
Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.
- CVSS v3.1
- 8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EPSS
- 0.75% chance of exploitation in the next 30 days, 52th percentile
- Published
- 2025-03-12
- Updated
- 2025-03-19
Proof-of-concept exploits (3)
- ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260
- plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5
- advisories/GHSA-mj4v-hp69-27x5