What’s Vulnerable › Vulnerabilities

CVE-2010-20120: Maple <= v13 Maplet File Creation and Command Execution

• Severity: high (CVSS 8.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-21 · updated 2026-06-16
• Weakness: CWE-94

Description

Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior bypasses standard security restrictions that normally prevent code execution in regular Maple worksheets. The vulnerability enables attackers to craft malicious .maplet files that execute arbitrary code without user interaction.

Affected products

• Maplesoft Maple: through 13

References

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/fileformat/maple_maplet.rb
• https://www.exploit-db.com/exploits/16308
• https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:MISC:MAPLE-MAPLET-CMD-EXEC.html
• https://www.maplesoft.com/products/maple/
• https://www.vulncheck.com/advisories/maple-maplet-file-creation-command-execution
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/fileformat/maple_maplet.rb
• https://www.exploit-db.com/exploits/16308

Get alerted when CVE-2010-20120 or the next vulnerability affects your stack