Skip to content
CVE Tracker
Back

CVE-2012-10049

WebPageTest Arbitrary PHP File Upload RCE

Critical9.3EPSS 1.8%
Published
Updated
Reserved
Assigned by
VulnCheck

Description

WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied input before saving uploaded files to a publicly accessible directory. This flaw allows remote attackers to upload and execute arbitrary PHP code, resulting in full remote code execution under the web server context.

Scores

CVSS scores of CVE-2012-10049, by who scored it
Scored byCVSSScoreVector
VulnCheckCNA (assigner)4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Deferred4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
1.8% · top 22% of all CVEs (3 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: yes · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

Affected products

  • WPO Foundation · WebPageTest

    • affected ≤ 2.6

References (6)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .