CVE-2025-26260

Katalog CVE

CVSS 8.8 · High EPSS 0,76%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada plenti. Skor CVSS 3.1 8.8 (High) menurut CISA ADP.

Deskripsi (NVD)

Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.

Rincian

Terbit di NVD

12 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5 exploit · advisory vendor
• https://ahmetakan.com/2025/02/14/cve-2025-26260/ exploit · advisory pihak ketiga
• https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260 exploit · advisory pihak ketiga
• https://github.com/plentico/plenti/releases/tag/v0.7.17 release notes