CVE-2012-10024

XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properly sanitize URI input, allowing authenticated users to request files outside the intended document root. An attacker can exploit this flaw to read arbitrary files from the host filesystem, including sensitive configuration or credential files.

• CWE-22

• https://github.com/xbmc/xbmc
• https://github.com/xbmc/xbmc/commit/bdff099c024521941cb0956fe01d99ab52a65335
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/gather/xbmc_traversal.rb
• https://www.ioactive.com/wp-content/uploads/pdfs/Security_Advisory_XBMC.pdf
• https://www.vulncheck.com/advisories/xbmc-web-server-path-traversal

Published

Aug 5, 2025

Last Modified

Jun 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-10019The Front End Editor plugin for WordPress is vulnerable to a…9.8
• CVE-2012-1002SQL injection vulnerability in author/edit.php in OpenConf 4…
• CVE-2012-10020The FoxyPress plugin for WordPress is vulnerable to arbitrar…9.8
• CVE-2012-10021A stack-based buffer overflow vulnerability exists in D-Link…9.8
• CVE-2012-10022Kloxo versions 6.1.12 and earlier contain two setuid root bi…8.5
• CVE-2012-10023A stack-based buffer overflow vulnerability exists in FreeFl…9.8
• CVE-2012-10025The WordPress plugin Advanced Custom Fields (ACF) version 3.…10
• CVE-2012-10026The WordPress plugin Asset-Manager version 2.0 and below con…10
• CVE-2012-10027WP-Property plugin for WordPress up to and including version…9.3
• CVE-2012-10028Netwin SurgeFTP version 23c8 and prior contains a vulnerabil…8.6
• CVE-2012-10029Nagios XI Network Monitor prior to Graph Explorer component …8.6
• CVE-2012-1003Multiple integer overflows in Opera 11.60 and earlier allow …