CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2025-26260
High (8.8) in plenti plenti. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in github.com/plentico/plenti 0.7.17.
Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plenti:plenti
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mj4v-hp69-27x5 | Go | github.com/plentico/plenti | <0.7.17 | 0.7.17 |
| GO-2025-3454 | Go | github.com/plentico/plenti | <0.7.17 | 0.7.17 |
| GO-2025-3515 | Go | github.com/plentico/plenti | all versions | no fix published |
References
- https://ahmetakan.com/2025/02/14/cve-2025-26260/
- https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260
- https://github.com/plentico/plenti/releases/tag/v0.7.17
- https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5
- https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5