CVE Daily

CVE-2012-10049

WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerabil...

Critical CVSS 9.3

Overview

WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied input before saving uploaded files to a publicly accessible directory. This flaw allows remote attackers to upload and execute arbitrary PHP code, resulting in full remote code execution under the web server context.

CWE: CWE-434 Published: 2025-08-08T19:15:35.040
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.3 (CRITICAL)
  • Detected tags: rce, upload (tag impact: VERY HIGH)

Recommended actions:

  • Patch/upgrade immediately (remote code execution).
  • Reduce exposure (WAF/segmentation), minimize attack surface.
  • Restrict types/MIME, store outside web root, inspect content.

Recommended tools

Tags