CVE-2013-10067 Glossword 1.8.8 - 1.8.12 Arbitrary File Upload RCE
Authenticated administrators can upload malicious PHP files to execute arbitrary code due to insufficient validation in Glossword.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-10067?
CVE-2013-10067 is a critical vulnerability in Glossword, published on 5 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface (gw_admin.php) allows users with administrator privileges to upload files to the gw_temp/a/ directory. Due to insufficient validation of file type and path, attackers can upload and execute PHP payloads, resulting in remote code execution.
Weakness: CWE-434
Which versions are affected by CVE-2013-10067?
How do I fix CVE-2013-10067?
No fix has been published for CVE-2013-10067 yet. Limit exposure of the affected software until one is available.
Is CVE-2013-10067 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-10067 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-5f49-66c7-6j3x.