Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php…

Pluck CMS versions through 4.7.21 contain a file upload restriction bypass vulnerability. The CMS uses a fixed blacklist in data/inc/files.php to block dangerous file extensions, but the blacklist omits the '.php8' extension. An authenticated administrator can upload a file with the '.php8' extension, which is stored unmodified on the server. On servers running PHP 8.x, the web server executes the uploaded file as PHP code, resulting in remote code execution. The vulnerability stems from an incomplete blacklist approach to file upload security rather than a whitelist approach. The fix requires updating the blacklist to include '.php8' or migrating to an allowlist-based approach.