{"id":"CVE-2022-26965","details":"In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.","modified":"2026-08-12T03:51:21.934456335Z","published":"2022-03-18T06:33:34Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26965.json"},"references":[{"type":"WEB","url":"https://packetstormsecurity.com/files/166336/Pluck-CMS-4.7.16-Shell-Upload.html"},{"type":"WEB","url":"https://youtu.be/sN6J_X4mEbY"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26965.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26965"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pluck-cms/pluck","events":[{"introduced":"1fd48a99a3d94d2db30a9c169e76720c47f2e1d0"},{"last_affected":"1fd48a99a3d94d2db30a9c169e76720c47f2e1d0"}],"database_specific":{"extracted_events":[{"introduced":"4.7.16"},{"last_affected":"4.7.16"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:pluck-cms:pluck:4.7.16:*:*:*:*:*:*:*"}}],"versions":["4.7.16"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26965.json"}}],"schema_version":"1.9.0"}