Critical severity9.8OSV Advisory· Published May 21, 2018· Updated Jun 17, 2026

CVE-2018-11331

Description

An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pluck/PluckOSV2 versions
4.7, 4.7.2, 4.7.3, …+ 1 more
- (no CPE)range: 4.7, 4.7.2, 4.7.3, …
- (no CPE)range: <4.7.6

Patches

Vulnerability mechanics

References

github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976envdPatchThird Party Advisory
github.com/pluck-cms/pluck/issues/58nvdIssue TrackingPatchThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000