Arbitrary file upload in Havalite Cms
CVE-2013-10055
An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a crafted multipart/form-data POST request. Once uploaded, the attacker can access the file directly under havalite/tmp/files/, resulting in remote code execution.
Vulnerability class: Unrestricted File Upload
EPSS: 0.011 (61.6th percentile) — read the EPSS interpretation.
Affected products
- Havalite Cms — versions 1.1.7
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2013-10055?
- CVE-2013-10055 is a vulnerability in Havalite Cms, classified under Unrestricted Upload of File with Dangerous Type. Published 2025-08-01.
- Is CVE-2013-10055 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.