Description
A security flaw has been discovered in PbootCMS up to 3.2.12. This affects an unknown function of the file core/function/file.php of the component File Upload. The manipulation of the argument black results in incomplete blacklist. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
References (4)
Core 4
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-352075 | PbootCMS File Upload file.php incomplete blacklist
https://vuldb.com/?id.352075
Signature, Permissions Required signature
permissions-required
VDB-352075 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/?ctiid.352075
Third Party Advisory third-party-advisory
Submit #773901 | 翱云科技 PbootCMS 3.2.12 Incomplete Identification of Uploaded File Variables
https://vuldb.com/?submit.773901
Scores
CVSS v3
6.3
EPSS
0.0029
EPSS Percentile
20.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-183
CWE-184
Status
published
Products (13)
n/a/PbootCMS
3.2.0
n/a/PbootCMS
3.2.1
n/a/PbootCMS
3.2.10
n/a/PbootCMS
3.2.11
n/a/PbootCMS
3.2.12
n/a/PbootCMS
3.2.2
n/a/PbootCMS
3.2.3
n/a/PbootCMS
3.2.4
n/a/PbootCMS
3.2.5
n/a/PbootCMS
3.2.6
... and 3 more
Published
Mar 21, 2026
Tracked Since
Mar 21, 2026