{"id":"GHSA-323w-6p85-26fr","summary":"Duplicate Advisory: Plenti  - Code Injection - Denial of Services","details":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mj4v-hp69-27x5. This link is maintained to preserve external references.\n\n# Original Description\nPlenti \u003c= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.","modified":"2025-03-12T21:58:24Z","published":"2025-03-12T18:32:53Z","withdrawn":"2025-03-12T21:58:24Z","database_specific":{"github_reviewed_at":"2025-03-12T21:58:24Z","nvd_published_at":"2025-03-12T16:15:23Z","cwe_ids":["CWE-94"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26260"},{"type":"WEB","url":"https://github.com/plentico/plenti/commit/c3e72a9ebbc2a03f4b0f3104becbfc25e390cb8e"},{"type":"WEB","url":"https://ahmetakan.com/2025/02/14/cve-2025-26260"},{"type":"WEB","url":"https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260"},{"type":"PACKAGE","url":"https://github.com/plentico/plenti"},{"type":"WEB","url":"https://github.com/plentico/plenti/releases/tag/v0.7.17"}],"affected":[{"package":{"name":"github.com/plentico/plenti","ecosystem":"Go","purl":"pkg:golang/github.com/plentico/plenti"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c 0.7.17","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-323w-6p85-26fr/GHSA-323w-6p85-26fr.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}