CVE-2012-10036
CVE-2012-10036 is a critical-severity vulnerability with a CVSS 4.0 base score of 9.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-434.
Key facts
- Severity: Critical (CVSS 4.0 base score 9.3)
- EPSS exploit prediction: 1% (66th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2012-6584
- Weakness: CWE-434
- Published:
- Last modified:
Description
Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. The uploaded file is stored with a predictable suffix and can be executed by requesting its URL, resulting in remote code execution.
Frequently asked questions
- What is CVE-2012-10036?
- Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php. The upload handler fails to validate the file type or enforce authentication, allowing remote attackers to upload malicious PHP files directly into a web-accessible directory. The uploaded file is stored with a predictable suffix and can be executed by requesting its URL, resulting in remote code execution.
- How severe is CVE-2012-10036?
- CVE-2012-10036 has a CVSS 4.0 base score of 9.3, rated critical severity.
- Is CVE-2012-10036 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2012-10036?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- Does CVE-2012-10036 have an EU (EUVD) identifier?
- Yes. CVE-2012-10036 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2012-6584.
- When was CVE-2012-10036 published?
- CVE-2012-10036 was published on 2025-08-08 and last updated on 2026-06-16.
References
- https://packetstorm.news/files/id/117070
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/projectpier_upload_exec.rb
- https://web.archive.org/web/20120111090432/http://www.projectpier.org/
- https://www.exploit-db.com/exploits/21929
- https://www.opensourcecms.com/projectpier/
- https://www.vulncheck.com/advisories/project-pier-arbitrary-file-upload-rce
Other CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities
- CVE-2026-56291 — Critical (CVSS 10.0): The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading…
- CVE-2026-48283 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type…
- CVE-2026-48276 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type…
- CVE-2026-57700 — Critical (CVSS 10.0): Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files. This…
- CVE-2025-69129 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site <= 1.0.7…
- CVE-2026-40772 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.
Browse all CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerabilities →