CVE-2012-10062CWE-306CWE-434

XAMPP WebDAV PHP Upload Authentication Bypass RCE

High · published August 30, 2025

CVSS v4.0
8.7
EPSS
2%
Percentile
79.2
In the wild
Unconfirmed
What it is

A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authenticated attackers to upload and execute arbitrary PHP code. The WebDAV service, accessible via /webdav/, accepts HTTP PUT requests using default credentials. This permits attackers to upload a malicious PHP payload and trigger its execution via a subsequent GET request, resulting in remote code execution on the server.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01884 · 79.2th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-08-30T13:57Z
EPSS history
Timeline
  • 30 AUG 13:57Z
    XAMPP WebDAV PHP Upload Authentication Bypass RCE
    cvelistv5