PT-2025-34310 · Maplesoft · Maple

Published 2025-08-21 · Updated 2025-08-22 · CVE-2010-20120

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Maple versions up to and including version 13

Description: Maple versions up to and including version 13 allow embedded commands to be executed automatically when a .maplet file is opened. This bypasses standard security restrictions that normally prevent code execution in Maple worksheets. This allows attackers to manipulate malicious .maplet files to execute arbitrary code without user interaction.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-20120

Affected Products

Maple

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2010-20120 · Security Note
• https://juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:MISC:MAPLE-MAPLET-CMD-EXEC.html · Note
• https://exploit-db.com/exploits/16308 · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/fileformat/maple_maplet.rb · Note
• https://vulncheck.com/advisories/maple-maplet-file-creation-command-execution · Note
• https://t.me/CVEtracker/30641 · Telegram Post
• https://maplesoft.com/products/maple · Note