{
"id": "GHSA-323w-6p85-26fr",
"aliases": [],
"details": "# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mj4v-hp69-27x5. This link is maintained to preserve external references.\n\n# Original Description\nPlenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.",
"summary": "Duplicate Advisory: Plenti - Code Injection - Denial of Services",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "github.com/plentico/plenti",
"ecosystem": "Go"
},
"database_specific": {
"last_known_affected_version_range": "< 0.7.17"
}
}
],
"modified": "2025-03-12T21:58:24Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"published": "2025-03-12T18:32:53Z",
"withdrawn": "2025-03-12T21:58:24Z",
"references": [
{
"url": "https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26260",
"type": "ADVISORY"
},
{
"url": "https://github.com/plentico/plenti/commit/c3e72a9ebbc2a03f4b0f3104becbfc25e390cb8e",
"type": "WEB"
},
{
"url": "https://ahmetakan.com/2025/02/14/cve-2025-26260",
"type": "WEB"
},
{
"url": "https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260",
"type": "WEB"
},
{
"url": "https://github.com/plentico/plenti",
"type": "PACKAGE"
},
{
"url": "https://github.com/plentico/plenti/releases/tag/v0.7.17",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2025-03-12T16:15:23Z",
"github_reviewed_at": "2025-03-12T21:58:24Z"
}
}