CVE-2014-7237

🗓️ 16 Oct 2014 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 45 Views🌐 WEB

TWiki Sandbox.pm in TWiki 6.0.0 allows remote attackers to bypass access restrictions and upload files with restricted names in Windows via null byte in filename

Reporter	Title	Published	Views	Family All 6
0day.today	Twiki Perl 4.x, 5.x, 6.x Upload Bypass / Code Execution Vulnerabilities	10 Oct 201400:00	–	zdt
Check Point Advisories	Twiki/Fosswiki Unauthenticated Arbitrary File Upload (CVE-2014-7237)	3 Dec 201400:00	–	checkpoint_advisories
Cvelist	CVE-2014-7237	16 Oct 201400:00	–	cvelist
NVD	CVE-2014-7237	16 Oct 201400:55	–	nvd
Packet Storm	Twiki Upload Bypass	10 Oct 201400:00	–	packetstorm
Prion	Code injection	16 Oct 201400:55	–	prion

NVD

Node

twiki twikiRange≤6.0.0

AND

microsoft windowsMatch-

Source	Link
twiki	www.twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7237
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/96952
securitytracker	www.securitytracker.com/id/1030982
seclists	www.seclists.org/fulldisclosure/2014/Oct/45

Parameter	Position	Path	Description	CWE
filepath2	path	bin/upload.cgi	Remote upload of a specially named file to TWiki Upload CGI that can bypass upload restrictions (null byte handling)	CWE-264
crypttoken	path	Research/TWiki-6.0.0/bin/upload.cgi/Main/WebHome	Attack example showing how a crafted filename can bypass protections to upload a .htaccess-like file via TWiki Upload CGI	CWE-264
filepath2	path	Research/TWiki-6.0.0/bin/upload.cgi/Main/WebHome	Attack example showing how a crafted filename can bypass protections to upload a .htaccess-like file via TWiki Upload CGI	CWE-264
debugenableplugins	query param	do/view/Main/WebHome	Exploitation vector for arbitrary Perl code execution via debugenableplugins parameter in view script	CWE-264

06 May 2026 22:30Current

7.6High risk

Vulners AI Score7.6

CVSS 26.8

EPSS0.29599

CWE-264