Skip to content
Fencer Intel
critical 9.3

CVE-2012-10052 json

EGallery 1.2 Arbitrary PHP File Upload

published 2025-08-08 15 mo ago modified 2026-06-16 4 mo ago also EUVD-2012-6588

cvss
9.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits
1
Metasploit

Summary

EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. This results in full remote code execution under the web server context.

Timeline

  1. First public exploit (Metasploit exploit/unix/webapp/egallery_upload_exec)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
15 mo ago

Exploit prediction

1.85% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Metasploit exploit/unix/webapp/egallery_upload_exec EGallery PHP File Upload Vulnerability metasploit exploit, excellent rank, 2012-07-08
  • raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/egallery_upload_exec.rb referenced PoC, tagged "exploit" by a source, unverified
  • exploit-db.com https://www.exploit-db.com/exploits/20029 referenced PoC, tagged "exploit" by a source, unverified
  • web.archive.org http://web.archive.org/web/20170128123244/http://www.opensyscom.fr/Actualites/egallery-arbitrary-file-upload-vulnerability.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • EGallery EGallery

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.