CVE-2012-10049 — WebPageTest Arbitrary PHP File Upload RCE
WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied in…
Published: 2025-08-08 · CVSS: 9.3 · CVSS 4.0
WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied input before saving uploaded files to a publicly accessible directory. This flaw allows remote attackers to upload and execute arbitrary PHP code, resulting in full remote code execution under the web server context.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7