CVE-2025-46099: 
Pluck CMS vulnerability analysis and mitigation

CVE-2025-46099 is an authenticated remote code execution (RCE) vulnerability in Pluck CMS version 4.7.20-dev, classified as an Unrestricted Upload of File with Dangerous Type (CWE-434). An authenticated attacker with admin panel access can upload a crafted PHP file via the Albums module and execute arbitrary commands through a GET parameter, exploiting flawed routing logic in albums.site.php. The vulnerability was published on July 23, 2025, and affects only the 4.7.20-dev release. It carries a CVSS v3.1 base score of 7.2 (High), requiring high privileges but no user interaction (Feedly, PoC GitHub).

The root cause is insufficient file type validation in the Pluck CMS Albums module (CWE-434), which allows authenticated administrators to upload PHP files — including those disguised with double extensions such as shell.php.jpg — to the data/modules/albums/ directory. The flawed routing logic in albums.site.php does not restrict direct HTTP access to uploaded files, enabling an attacker to access the uploaded PHP shell via a crafted URL (e.g., https://<host>/data/modules/albums/shell.php?cmd=id) and trigger arbitrary command execution through a user-controlled GET parameter. Exploitation requires authenticated access to the admin panel but no additional user interaction. A public proof-of-concept write-up detailing the attack steps is available on GitHub (PoC GitHub).

Successful exploitation grants the attacker arbitrary remote code execution within the web server's security context, enabling full server compromise including unauthorized access to sensitive data, modification or deletion of system files, and disruption of service availability. Because the uploaded PHP shell persists on the server, an attacker can maintain persistent access and potentially pivot to other internal systems reachable from the web server. All three pillars of security — confidentiality, integrity, and availability — are rated HIGH in the CVSS assessment (Feedly, PoC GitHub).

1. Reconnaissance: Identify internet-facing Pluck CMS instances running version 4.7.20-dev, using web fingerprinting tools or search engines (e.g., Shodan, Censys) to locate the admin login page.
2. Authentication: Log in to the Pluck CMS admin panel using valid administrator credentials.
3. Prepare malicious file: Create a PHP web shell file (e.g., shell.php or disguised as shell.php.jpg) containing a payload such as <?php system($_GET['cmd']); ?>.
4. Upload via Albums module: Navigate to the Albums module in the admin panel and upload the crafted PHP file, bypassing client-side or server-side file type validation.
5. Rename/manipulate file: If the file was uploaded with a disguised extension, rename or manipulate it to restore the .php extension within the data/modules/albums/ directory.
6. Trigger RCE: Access the uploaded shell via a direct HTTP GET request, e.g., https://<target>/data/modules/albums/shell.php?cmd=id, to execute arbitrary OS commands through the cmd parameter.
7. Establish persistence: Use the shell to deploy a more persistent backdoor, exfiltrate data, or pivot to internal network resources (PoC GitHub).

• Network: Unusual HTTP GET requests to paths matching /data/modules/albums/*.php with query parameters such as ?cmd= or ?exec=; outbound connections from the web server process to unexpected external IPs.
• File System: Presence of unexpected .php files (e.g., shell.php, cmd.php) in the data/modules/albums/ directory; files with double extensions (e.g., .php.jpg) in the same directory.
• Logs: Web server access logs showing GET requests to /data/modules/albums/<filename>.php with command-like query strings; admin panel logs showing file uploads followed shortly by direct file access requests.
• Process: Unusual child processes spawned by the web server process (e.g., sh, bash, curl, wget, python) executing system commands not typical of normal CMS operation (PoC GitHub).

No official vendor patch has been released for Pluck CMS 4.7.20-dev as of the time of disclosure. Recommended mitigations include: restricting file uploads in the Albums module to safe image MIME types only; moving uploaded files outside the web root or blocking PHP execution in the data/modules/albums/ directory via .htaccess rules or web server configuration; applying a WAF rule to block direct HTTP access to .php files in the albums directory; and limiting admin panel access to trusted IP addresses. Organizations should monitor the Pluck CMS GitHub repository for security updates and apply patches as soon as they become available (Feedly, PoC GitHub).

The vulnerability was discovered and reported by researcher Chayawat Jeamprasertboon, who published a detailed write-up and proof-of-concept on GitHub. Red Hat has acknowledged the CVE in their security advisory database. No significant broader media coverage or notable community debate has been observed beyond standard CVE aggregator listings (PoC GitHub, Red Hat Advisory).