CVE-2020-29607

🗓️ 16 Dec 2020 14:28:27Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 140 Views🌐 WEB

A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain host access through "manage files" functionality, leading to remote code execution

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck	28 Feb 202600:00	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck	27 Oct 202500:46	–	githubexploit
0day.today	Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated) Exploit	26 May 202100:00	–	zdt
Circl	CVE-2020-29607	16 Dec 202018:41	–	circl
CNNVD	Pluck Code Issue Vulnerability	16 Dec 202000:00	–	cnnvd
Check Point Advisories	p0wny Shell Remote Code Execution (CVE-2017-9830; CVE-2018-15139; CVE-2018-19423; CVE-2018-6383; CVE-2020-29607; CVE-2021-24155; CVE-2021-24347)	19 Oct 202100:00	–	checkpoint_advisories
Cvelist	CVE-2020-29607	16 Dec 202014:28	–	cvelist
Exploit DB	Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated)	26 May 202100:00	–	exploitdb
NVD	CVE-2020-29607	16 Dec 202015:15	–	nvd
OSV	CVE-2020-29607	16 Dec 202015:15	–	osv

NVD

Node

pluck-cms pluckRange<4.7.13

Source	Link
github	www.github.com/pluck-cms/pluck/issues/96
github	www.github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2020-29607.md
github	www.github.com/Hacker5preme/Exploits/tree/main/CVE-2020-29607-Exploit
packetstormsecurity	www.packetstormsecurity.com/files/162785/Pluck-CMS-4.7.13-Remote-Shell-Upload.html

Parameter	Position	Path	Description	CWE
filefile	request body	<pluckcmspath>/admin.php?action=files	Authenticated file upload leading to remote code execution via admin manage files in Pluck CMS (<4.7.13).	CWE-434

17 Jun 2026 03:11Current

7.5High risk

Vulners AI Score7.5

CVSS 26.5

CVSS 3.17.2

EPSS0.33428

CWE-434