CVE-2012-10050CWE-434

CuteFlow <= 2.11.2 Arbitrary File Upload RCE

Critical · published August 8, 2025

CVSS v4.0
9.3
EPSS
2%
Percentile
79.2
In the wild
Unconfirmed
What it is

CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/___1/ directory. These files are then accessible via the web server, enabling remote code execution.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01881 · 79.2th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-08-08T18:10Z
EPSS history
Timeline
  • 08 AUG 18:10Z
    CuteFlow <= 2.11.2 Arbitrary File Upload RCE
    cvelistv5