What’s Vulnerable › Vulnerabilities

CVE-2018-10574

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-04-30 · updated 2026-06-17
• Weakness: CWE-94

Description

site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.

Affected products

• Bigtreecms Bigtree Cms: through 4.2.22

References

• https://github.com/bigtreecms/BigTree-CMS/commit/609bd17728ee1db0487a42d96028d30537528ae8
• https://github.com/bigtreecms/BigTree-CMS/issues/335
• https://github.com/bigtreecms/BigTree-CMS/commit/609bd17728ee1db0487a42d96028d30537528ae8
• https://github.com/bigtreecms/BigTree-CMS/issues/335

Get alerted when CVE-2018-10574 or the next vulnerability affects your stack