CVE-2012-10050 CRITICAL

CVE-2012-10050: CuteFlow <= 2.11.2 Arbitrary File Upload RCE

Vendor Cuteflow.org

Product CuteFlow

Weakness CWE-434 · Unrestricted file upload

Published August 8, 2025

Last update May 15, 2026

View on NVD All CVEs

CVSS base score

9.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/___1/ directory. These files are then accessible via the web server, enabling remote code execution.

Key dates

02Disclosure timeline

August 8, 2025 CVE published

May 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2012-10050 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2024-2531 MAGESH-K21 Online-College-Event-Hall-Reservation-System update-rooms.php unrestricted upload CVE-2025-2396 e-Excellence U-Office Force - Arbitrary File Upload CVE-2025-67924 WordPress Corpkit theme <= 2.0 - Arbitrary File Upload vulnerability CVE-2024-30231 WordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerability CVE-2023-5488 Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform updatelib.php unrestricted upload