CVE Daily

CVE-2013-10067

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file ...

Critical CVSS 9.4

Overview

Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability. When deployed as a standalone application, the administrative interface (gw_admin.php) allows users with administrator privileges to upload files to the gw_temp/a/ directory. Due to insufficient validation of file type and path, attackers can upload and execute PHP payloads, resulting in remote code execution.

CWE: CWE-434 Published: 2025-08-05T20:15:35.387
Risk analysis

This vulnerability is rated 🔴 CRITICAL.

  • CVSS: 9.4 (CRITICAL)
  • Detected tags: rce, upload (tag impact: VERY HIGH)

Recommended actions:

  • Patch/upgrade immediately (remote code execution).
  • Reduce exposure (WAF/segmentation), minimize attack surface.
  • Restrict types/MIME, store outside web root, inspect content.

Recommended tools

Tags