CVE-2025-26260

Description

Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.

Weakness classification

• 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-94

Primary references

• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Release Notes
• cve@mitre.org — Exploit, Vendor Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Vendor Advisory