GCVE - cpe:2.3:a:plenti:plenti:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:plenti:plenti:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Plenti (`352c215a-85ad-5925-b1b1-a2a5820cd08e`)
Product	Plenti (`60213924-e8ae-5c4e-a81d-e3a61da1137e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/plentico/plenti`	purl2cpe	2026-06-01 10:18:07.818400

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-26260`	vulnerable	2026-06-08 07:12:51.501894	Details available Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution. Published: 2025-03-12T00:00:00.000Z Updated: 2025-03-19T18:59:02.952Z Open on db.gcve.eu Reference links https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5 https://github.com/plentico/plenti/releases/tag/v0.7.17 https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260 https://ahmetakan.com/2025/02/14/cve-2025-26260/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-49381`	vulnerable	2026-06-08 06:50:13.750114	Plenti arbitrary file deletion vulnerability Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletion when a plenti user serves their website. This issue may lead to information loss. Version 0.7.2 fixes the vulnerability. Published: 2024-10-25T13:06:13.307Z Updated: 2024-10-25T13:47:34.600Z Open on db.gcve.eu Reference links https://securitylab.github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti/ https://github.com/plentico/plenti/blob/01825e0dcd3505fac57adc2edf29f772d585c008/cmd/serve.go#L205 https://github.com/plentico/plenti/releases/tag/v0.7.2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-49380`	vulnerable	2026-06-08 06:50:13.749453	Plenti arbitrary file write vulnerability Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the vulnerability. Published: 2024-10-25T13:04:01.815Z Updated: 2024-10-25T14:24:31.224Z Open on db.gcve.eu Reference links https://securitylab.github.com/advisories/GHSL-2024-297_GHSL-2024-298_plenti/ https://github.com/plentico/plenti/blob/01825e0dcd3505fac57adc2edf29f772d585c008/cmd/serve.go#L205 https://github.com/plentico/plenti/releases/tag/v0.7.2	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.