CVE-2008-6253: Pluck-CMS Pluck

Medium severity, CVSS 6.8. EPSS: 5% chance of exploitation in the next 30 days.

Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the g_pcltar_lib_dir parameter.

Affected products

• Pluck-CMS Pluck: version 4.5.3 only

Published 2009-02-24. Last modified 2026-06-16.