CVE-2026-54416: Pluck CMS File Upload RCE Vulnerability

CVE-2026-54416 Overview

CVE-2026-54416 affects Pluck CMS through version 4.7.21. The vulnerability resides in the admin file-management feature, which restricts dangerous uploads using a fixed blacklist in data/inc/files.php. The blacklist covers extensions such as .php, .php3–.php7, .phtml, .phar, .asp, and .cgi, but omits .php8. An authenticated administrator can upload a file named shell.php8, which the server stores unmodified. On hosts running PHP 8.x, the web server executes the file as PHP, producing remote code execution [CWE-434].

Critical Impact
Authenticated administrators can achieve remote code execution on Pluck CMS instances hosted on PHP 8.x by uploading files with the .php8 extension.

Affected Products

Pluck CMS versions through 4.7.21
Deployments running on PHP 8.x web servers
Installations exposing the admin file-management module

Discovery Timeline

2026-08-05 - CVE-2026-54416 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-54416

Vulnerability Analysis

Pluck CMS enforces upload restrictions through a denylist rather than an allowlist. The file data/inc/files.php defines a fixed array of forbidden extensions and compares the last 4–5 characters of each uploaded filename against that array. Any extension outside the list passes validation.

PHP 8 introduced the .php8 extension as a common mapping used by mainstream Apache and Nginx configurations to route requests to the PHP 8 interpreter. The Pluck blacklist predates this convention and does not include .php8. As a result, files ending in .php8 bypass the filter entirely and are written to a web-accessible directory.

Exploitation requires administrator credentials, which raises the barrier but does not eliminate risk. Compromised or shared admin accounts, weak passwords, or chained authentication flaws can grant the required access. Once uploaded, the attacker requests the file over HTTP and the web server hands execution to PHP.

Root Cause

The root cause is reliance on an incomplete deny-by-list model for dangerous file type filtering. The check inspects only the trailing characters of the filename, and the maintainers did not update the list when PHP 8 introduced the .php8 extension convention. See the Pluck CMS GitHub repository for the affected source.

Attack Vector

An authenticated administrator authenticates to the Pluck admin panel, navigates to the file-management feature, and uploads a PHP payload renamed with the .php8 extension. The server stores the file without transformation. The attacker then issues an HTTP request to the stored file path, causing the PHP 8 interpreter to execute the payload with the privileges of the web server user.

No verified public exploit code is available. See the Pluck CMS repository for the vulnerable filter implementation.

Detection Methods for CVE-2026-54416

Indicators of Compromise

Files with the .php8 extension present in Pluck CMS upload directories, particularly under data/files/
Web server access logs showing HTTP GET or POST requests to .php8 resources hosted by Pluck
New or unexpected administrator sessions preceding uploads to the file-management module
Outbound network connections from the web server process to unfamiliar hosts following file uploads

Detection Strategies

Inspect Pluck CMS upload directories for files whose extensions match .php8, .phtm, or other executable variants that the application should not host.
Correlate authenticated admin activity in admin.php with subsequent file writes and HTTP requests to newly created files.
Alert on web server processes spawning shell interpreters such as sh, bash, or cmd.exe following requests to Pluck-hosted PHP files.

Monitoring Recommendations

Enable file integrity monitoring on all Pluck web root and data/files/ directories.
Forward web server access logs and PHP-FPM logs to a central analytics platform for anomaly review.
Track administrator login events and flag logins from unfamiliar IP addresses or user agents.

How to Mitigate CVE-2026-54416

Immediate Actions Required

Audit Pluck CMS installations for files ending in .php8 and remove any that were not placed by an authorized administrator.
Restrict access to the Pluck admin interface using network controls, VPN, or IP allowlists.
Rotate administrator credentials and enforce strong password policies on all admin accounts.
Configure the web server to refuse execution of PHP files in upload directories.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Monitor the Pluck CMS GitHub repository for an updated release that extends the blacklist to include .php8 and any future PHP-related extensions, or that migrates the upload filter to an allowlist model.

Workarounds

Add a web server rule that denies execution of .php8, .phtm, .pht, and similar PHP handler extensions inside the Pluck upload directory.
Modify data/inc/files.php locally to append .php8 to the denied extension array as an interim measure.
Disable the file-management feature for administrators who do not require it.
Deploy a web application firewall rule that blocks multipart uploads containing filenames ending in .php8 to the Pluck admin endpoint.

bash

# Apache configuration example: block execution of dangerous extensions in Pluck uploads
<Directory "/var/www/pluck/data/files">
    <FilesMatch "\.(php[0-9]?|phtml|phtm|pht|phar|asp|cgi)$">
        Require all denied
    </FilesMatch>
    php_flag engine off
</Directory>