Description
Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250313T170021-1.1 | openSUSE-SU-2025:14893-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/plentico/plenti | < 0.7.17 | 0.7.17 | GHSA-mj4v-hp69-27x5 |
| Go | github.com/plentico/plenti | all versions | — | GO-2025-3515 |
Advisories 1
- openSUSE-SU-2025:14893-1 govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026