← Vulnerability feed

Vulnerability record · CVE-2007-4180 · published 8 August 2007

CVE-2007-4180: Pluck vulnerability

PPluck · Pluck

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to read arbitrary local files via a .. (dot dot) in the file parameter. NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argument when invoking fputs, which cannot be used to read files

5.0 CVSS 2.0 Medium EPSS 1.5% · top 27.1%
5.0CVSS 2.0 base score
1.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
16 Jun 2026Last modified by NVD

Description

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to read arbitrary local files via a .. (dot dot) in the file parameter. NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argument when invoking fputs, which cannot be used to read files

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://outlaw.aria-security.info/?p=12
http://securityreason.com/securityalert/2973
http://www.attrition.org/pipermail/vim/2007-August/001752.html
http://www.securityfocus.com/archive/1/475323/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/35757
http://outlaw.aria-security.info/?p=12
http://securityreason.com/securityalert/2973
http://www.attrition.org/pipermail/vim/2007-August/001752.html
http://www.securityfocus.com/archive/1/475323/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/35757

Track CVE-2007-4180 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.8CVE-2008-3194Pluck path traversal vulnerabilityMultiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php in pluck 4.5.1 allow remote attackers to include and execute…EPSS 2.6%6.8CVE-2007-4181Pluck vulnerabilityPHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to execute arbi…EPSS 1.6%5.0CVE-2008-3851Pluck path traversal vulnerabilityMultiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a …EPSS 7.9%2.6CVE-2008-3574Pluck cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals is enabled, allow remote attackers to inject arbitrary web …EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2007-4180), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.