Arbitrary file upload in Cuteflow.org Cuteflow
CVE-2012-10050
CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers t…
Vulnerability class: Unrestricted File Upload
EPSS: 0.760 (98.9th percentile) — read the EPSS interpretation.
Affected products
- Cuteflow.org Cuteflow — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- web.archive.org/web/20120729071444/http://www.cuteflow.org/ (product)
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/m… (exploit)
- www.exploit-db.com/exploits/20111 (exploit)
- web.archive.org/web/20210922054637/https://itsecuritysolutions.org/2012-07-01-C… (technical-description, exploit)
- sourceforge.net/projects/cuteflow/ (product)
- www.vulncheck.com/advisories/cuteflow-arbitrary-file-upload-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2012-10050?
- CVE-2012-10050 is a vulnerability in Cuteflow.org Cuteflow, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-08.
- Is CVE-2012-10050 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.