Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticat…

published 2013-06-01 13y ago modified 2026-06-16 4mo ago also EUVD-2013-0179

cvss: 8.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 40.3%; EPSS 40.3% chance of exploitation in 30 days, percentile 98%
public exploits: 3; Metasploit and Exploit-DB

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.

Is CVE-2013-0136 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2013-05-15 First public exploit (Metasploit auxiliary/admin/http/mutiny_frontend_read_delete)
2013-06-01 Published

Exploit prediction

40.34% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit auxiliary/admin/http/mutiny_frontend_read_delete Mutiny 5 Arbitrary File Read and Delete metasploit auxiliary, normal rank, 2013-05-15
Metasploit exploit/linux/http/mutiny_frontend_upload Mutiny 5 Arbitrary File Upload metasploit exploit, excellent rank, 2013-05-15
EDB-25517 Mutiny 5 - Arbitrary File Upload (Metasploit) remote, 2013-05-17
community.rapid7.com https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	8.5	AV:N/AC:M/Au:S/C:C/I:C/A:C

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

community.rapid7.com /community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities
exploit
kb.cert.org /vuls/id/701572
third-party-advisory, us-government-resource

Sources

CVE List CVE-2013-0136
NVD CVE-2013-0136

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.