CVE-2020-10963
FrozenNode Laravel-Administrator unrestricted file upload
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
- Record
CVE-2020-10963- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
- Record
CVE-2020-10963- Updated
- 2026-11-02
EUVDEUVD-2022-3437 No score
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
- Record
EUVD-2022-3437- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9r2j-rg24-fvpj
FrozenNode Laravel-Administrator unrestricted file upload
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
- Record
GHSA-9r2j-rg24-fvpj- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
- Record
CVE-2020-10963- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-9r2j-rg24-fvpj
FrozenNode Laravel-Administrator unrestricted file upload
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
- Record
GHSA-9r2j-rg24-fvpj- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
frozennode/administratorPackagist |
through 5.0.12 | None known |
frozennode/administratorPackagist |
through 5.0.12, plus listed versions 4.16.2v4.0.0v4.0.1v4.1.0v4.10.0 Show 43 moreShow lessv4.11.0v4.11.1v4.11.2v4.12.0v4.12.1v4.13.0v4.14.0v4.14.1v4.14.2v4.15.0v4.16.0v4.16.1v4.16.3v4.16.4v4.16.5v4.16.6v4.16.7v4.17v4.2.0v4.3.0v4.4.0v4.4.1v4.5.0v4.6.0v4.6.1v4.7.0v4.7.1v4.7.2v4.8.0v4.9.0v5.0.0v5.0.1v5.0.10v5.0.11v5.0.12v5.0.2v5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Laravel Administrator 4 - Unrestricted File Upload (Authenticated) | 2020-11-27 |
| PoC in GitHub | scopion/CVE-2020-10963 | 2021-10-29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10963 is a high vulnerability (CVSS 7.2) in Frozennode Laravel-administrator, published March 25, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 14.7%, the 96th percentile. No source names a fixed version.