CVE-2012-2939: Multiple unrestricted file upload vulnerabilities in Travelon Express 6.2.2 allow remote authenticated user...

Security readout for executives and security teams

Travelon Express 6.2.2 has multiple authenticated file-upload flaws that may let a logged-in remote user place executable files on the web server and run code. This is a serious legacy-web-application risk, but the supplied sources do not provide CVSS, vendor patch details, or evidence of active exploitation. Exposure appears limited to organizations still running Travelon Express CMS 6.2.2, especially where the named PHP upload routes are reachable by authenticated users. Asset discovery may be difficult because the source bundle lists no vendor, product CPE, or version-mapping data beyond the CVE description. Treat as high priority for any remaining Travelon Express 6.2.2 deployment. The product appears old, remediation data is sparse, and successful exploitation could give an authenticated user code execution on the web server. Mitigation focus: Check vendor or maintainer guidance for a fixed release or supported workaround.; Restrict access to affected upload routes to trusted administrators only.; Disable affected upload features if they are not operationally required..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.