CVE-2013-10054 LibrettoCMS File Manager Arbitrary File Upload
Unauthenticated attackers can upload malicious files to LibrettoCMS File Manager to achieve remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-10054?
CVE-2013-10054 is a critical vulnerability in LibrettoCMS, published on 4 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated arbitrary file upload vulnerability exists in LibrettoCMS version 1.1.7 (and possibly earlier) contains an unauthenticated arbitrary file upload vulnerability in its File Manager plugin. The upload handler located at adm/ui/js/ckeditor/plugins/pgrfilemanager/php/upload.php fails to properly validate file extensions, allowing attackers to upload files with misleading extensions and subsequently rename them to executable .php scripts. This enables remote code execution on the server without authentication.
Weakness: CWE-434
Which versions are affected by CVE-2013-10054?
How do I fix CVE-2013-10054?
No fix has been published for CVE-2013-10054 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-10054 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-10054 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-7xcq-239h-p5hq.