Arbitrary file upload in Egallery
CVE-2012-10052
EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. This results in full remote code execution under the web server context.
Vulnerability class: Unrestricted File Upload
Published · last modified .
EPSS exploit prediction
EPSS: 0.016 (75.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.011 · newest: 0.016 · change: +0.005
Affected products
- Egallery — versions 1.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/u… (exploit)
- www.exploit-db.com/exploits/20029 (exploit)
- web.archive.org/web/20170128123244/http://www.opensyscom.fr/Actualites/egallery… (technical-description, exploit)
- sourceforge.net/projects/e-gallery/ (product)
- www.vulncheck.com/advisories/egallery-arbitrary-php-file-upload (third-party-advisory)
Frequently asked questions
- What is CVE-2012-10052?
- CVE-2012-10052 is a vulnerability in Egallery, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-08.
- Is CVE-2012-10052 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.