CVE-2012-10052

CVE-2012-10052 is a critical unauthenticated arbitrary file upload vulnerability in EGallery version 1.2, specifically within the uploadify.php script. This flaw allows remote attackers to upload malicious PHP files directly into the web-accessible directory due to a lack of file type validation and authentication. Successful exploitation grants full remote code execution under the web server's context. The vulnerability has a CVSSv4 score of 9.3 (CRITICAL), indicating a severe risk with a network attack vector and low attack complexity, requiring no user interaction or privileges. The potential impact includes high confidentiality, integrity, and availability compromise. While not listed on the KEV catalog, exploit code is publicly available via a Metasploit module, and the vulnerability has a high EPSS score and FAUCET Risk Score of 99/100, suggesting a significant likelihood of exploitation. Community discussion is also notably high, with 20 mentions.