CVE-2012-2670

CVE-2012-2670 describes an arbitrary file upload and execution vulnerability in Collabtive versions prior to 0.7.6, specifically within the manageuser.php component. This flaw allows remote authenticated users, and potentially unauthenticated attackers, to bypass access restrictions by uploading a malicious avatar file with an accepted Content-Type, then directly accessing it to execute arbitrary code. The vulnerability carries a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring single authentication, and leading to partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.