CVE-2024-9405

Pluck CMS has a path-traversal flaw letting an unauthenticated attacker read files via an absolute path, but the advisory is candid about its limits: it reaches files in the same directory or subdirectory as the module, not recursively across the filesystem. So it's a bounded disclosure — real, unauthenticated, but constrained in what it can actually pull.

That boundary keeps this in moderate territory. Unauthenticated traversal invites scanning, and disclosure can surface a useful file, but the non-recursive limitation means it isn't the sweeping read-any-file primitive that makes traversal bugs dangerous. Its value to an attacker is opportunistic — whatever sensitive file happens to sit near the module — rather than a reliable path to secrets anywhere on disk.

We rank this in line with its constrained impact and handle it through exposure awareness. The check is whether any Pluck CMS instance is internet-reachable, since that's where an unauthenticated leak matters, and then updating it on the normal cycle. Where immediate patching lags, a proxy rule blocking traversal sequences is a cheap stopgap, but the limited scope means this doesn't jump ahead of the batch's higher-impact disclosure bugs.