GO-2025-3515 CVE-2025-26260 in github.com/plentico/plenti

CVE-2025-26260 in github.com/plentico/plenti...

CVE-2025-26260

Plenti = 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution...

CVE-2025-26260

Summary: CVE-2025-26260 affects Plenti

CVE-2025-26260

Plenti = 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution...

CVE-2025-26260

Plenti = 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution...

CVE-2025-26260

creationtimestamp| type| source ---|---|--- 2025-02-05 21:30:53+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-mj4v-hp69-27x5 2025-03-12 19:25:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lk7cptr6se2h 2025-03-12 20:23:03+00:00| seen|...