PT-2025-31976 · Xbmc · Xbmc

Published 2025-08-05 · Updated 2025-08-05 · CVE-2012-10024

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions XBMC versions prior to the 2012-11-04 nightly release XBMC version 11

Description XBMC version 11, including builds up to the 2012-11-04 nightly release, contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properly sanitize URI input, allowing authenticated users to request files outside the intended document root. An attacker can exploit this flaw to read arbitrary files from the host filesystem, including sensitive configuration or credential files.

Recommendations Update XBMC to a version later than the 2012-11-04 nightly release.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-10024

Affected Products

Xbmc

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-10024 · Security Note
• https://github.com/xbmc/xbmc · Note
• https://github.com/xbmc/xbmc/commit/bdff099c024521941cb0956fe01d99ab52a65335 · Note
• https://ioactive.com/wp-content/uploads/pdfs/Security_Advisory_XBMC.pdf · Note
• https://t.me/CVEtracker/29230 · Telegram Post
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/gather/xbmc_traversal.rb · Note
• https://vulncheck.com/advisories/xbmc-web-server-path-traversal · Note