What is CVE-2013-10054?

CVE-2013-10054 is a vulnerability in Librettocms, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-04.

Is CVE-2013-10054 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Arbitrary file upload in Librettocms

CVE-2013-10054

An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails to properly validate file extensions, allowing attackers to upload files with misleading extensions and subsequently rename them to executable .php scripts. This enables remote code execution on the server without authentication.

Vulnerability class: Unrestricted File Upload

EPSS: 0.013 (67.1th percentile) — read the EPSS interpretation.

Affected products

Librettocms — versions 1.1.7

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

Public proof-of-concept exploits

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2013-10054?: CVE-2013-10054 is a vulnerability in Librettocms, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-04.
Is CVE-2013-10054 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.