Arbitrary file upload in Cuteflow.org Cuteflow
CVE-2012-10050
CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/___1/ directory. These files are then accessible via the web server, enabling remote code execution.
Vulnerability class: Unrestricted File Upload
Published · last modified .
EPSS exploit prediction
EPSS: 0.019 (78.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 78th percentile — 78.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.019 · change: +0.006
Affected products
- Cuteflow.org Cuteflow — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- web.archive.org/web/20120729071444/http://www.cuteflow.org/ (product)
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/m… (exploit)
- www.exploit-db.com/exploits/20111 (exploit)
- web.archive.org/web/20210922054637/https://itsecuritysolutions.org/2012-07-01-C… (technical-description, exploit)
- sourceforge.net/projects/cuteflow/ (product)
- www.vulncheck.com/advisories/cuteflow-arbitrary-file-upload-rce (third-party-advisory)
Frequently asked questions
- What is CVE-2012-10050?
- CVE-2012-10050 is a vulnerability in Cuteflow.org Cuteflow, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-08.
- Is CVE-2012-10050 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.