CVE-2020-20969

This exploit demonstrates an unrestricted file upload vulnerability in PluckCMS 4.7.10, allowing an authenticated attacker to restore a malicious file from the trash directory and achieve remote code execution (RCE). The attack requires a valid session cookie and a pre-uploaded file with a double extension to bypass filtering.