CVE-2012-10024 XBMC ≤ 11.0 Web Server Path Traversal
Authenticated attackers can exploit a path traversal flaw in XBMC's embedded HTTP server to read arbitrary files from the host filesystem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-10024?
CVE-2012-10024 is a high-severity path traversal vulnerability in XBMC Media Center, published on 5 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properly sanitize URI input, allowing authenticated users to request files outside the intended document root. An attacker can exploit this flaw to read arbitrary files from the host filesystem, including sensitive configuration or credential files.
Weakness: CWE-22
Which versions are affected by CVE-2012-10024?
How do I fix CVE-2012-10024?
No fix has been published for CVE-2012-10024 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2012-10024 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-10024 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-4754-xhrr-vjvp.