CVE-2012-2670: manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated a...

Security readout for executives and security teams

Collabtive versions before 0.7.6 had an avatar upload flaw that could allow an attacker to place and run arbitrary files on the server. The record says authenticated users are affected, with possible unauthenticated access not fully confirmed. For any remaining legacy Collabtive deployment, this is a serious server-compromise risk. Exposure is most likely on legacy Collabtive instances older than 0.7.6 where profile or user-management avatar upload functionality is reachable. Public-facing deployments are higher risk. The CVE data does not provide CPEs, CVSS, or a complete authentication requirement. Prioritize remediation if Collabtive is still deployed, especially on internet-facing systems. Although active exploitation is not evidenced in the bundle, the vulnerability class can lead to full application server compromise and affects very old software. Mitigation focus: Upgrade Collabtive to 0.7.6 or later where still in use.; Retire or isolate unsupported legacy Collabtive deployments.; Restrict access to user-management and avatar upload functions until upgraded..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.