CVE-2016-9268 — Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors

Back Back to CVE browser

HIGH

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors

Published Nov 10, 2016

7.2

HIGH

CVSS 3.0

EPSS 5.00%

Description

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors.

Affected products

Remediation

No remediation recorded yet.

Metrics

5.00% 0.05000

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.05000

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	5.00% (0.05000)	91.97th	v5 (v2026.06.15)
Jun 15, 2026	5.00% (0.05000)	91.09th	v5 (v2026.06.15)
Mar 17, 2025	0.94% (0.00937)	74.59th	v4 (v2025.03.14)
Dec 12, 2024	0.94% (0.00937)	83.73th	v3 (v2023.03.01)
Mar 6, 2024	0.92% (0.00916)	82.42th	v3 (v2023.03.01)
Mar 7, 2023	0.92% (0.00916)	80.42th	v3 (v2023.03.01)
Mar 6, 2023	4.70% (0.04695)	89.17th	v2 (v2022.01.01)
Apr 1, 2022	4.70% (0.04695)	88.08th	v2 (v2022.01.01)
Feb 4, 2022	4.70% (0.04695)	74.44th	v2 (v2022.01.01)

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (3)

http://dev.dotclear.org/2.0/changeset/445e9ff79a1fa81033591761d6a340e219d159b2
x_refsource_CONFIRMIssue TrackingPatch
http://dev.dotclear.org/2.0/ticket/2214
x_refsource_CONFIRMMitigationVendor Advisory
http://www.securityfocus.com/bid/94246
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://dev.dotclear.org/2.0/changeset/445e9ff79a1fa81033591761d6a340e219d159b2		x_refsource_CONFIRMIssue TrackingPatch
http://dev.dotclear.org/2.0/ticket/2214		x_refsource_CONFIRMMitigationVendor Advisory
http://www.securityfocus.com/bid/94246		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Nov 10, 2016

Updated Aug 6, 2024

Reserved Nov 10, 2016

Link CVE-2016-9268

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2016-9268

Red Hat

Severity n/a

Public date n/a

Links CVE-2016-9268