Arbitrary file upload in Projectpier
CVE-2012-10036
Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. The uploaded file is stored with a predictable suffix and can be executed by requesting its URL, resulting in remote code execution.
Vulnerability class: Unrestricted File Upload
Published · last modified .
EPSS exploit prediction
EPSS: 0.018 (77.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 77.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.012 · newest: 0.018 · change: +0.005
Affected products
- Projectpier — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/u… (exploit)
- www.exploit-db.com/exploits/21929 (exploit)
- packetstorm.news/files/id/117070 (exploit)
- web.archive.org/web/20120111090432/http://www.projectpier.org/ (product)
- www.opensourcecms.com/projectpier/ (product)
- www.vulncheck.com/advisories/project-pier-arbitrary-file-upload-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2012-10036?
- CVE-2012-10036 is a vulnerability in Projectpier, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-08.
- Is CVE-2012-10036 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.