CVE-2012-5907: Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remot...

Security readout for executives and security teams

CVE-2012-5907 is a directory traversal issue in TomatoCart’s json.php. A remote attacker could potentially read files from the server if the vulnerable TomatoCart version is exposed. This matters most for legacy e-commerce systems that may hold configuration secrets or customer-related data. Exposure is likely limited to legacy TomatoCart deployments, especially version 1.2.0 Alpha 2 or earlier, with json.php reachable from untrusted networks. The source bundle does not confirm other affected products or maintained branches. Treat as high priority if TomatoCart is still exposed. Remote file read in an e-commerce stack can expose credentials and configuration data, but urgency depends on whether this legacy software exists in your environment. Mitigation focus: Identify any TomatoCart deployments and their exact versions.; Remove internet exposure for affected legacy instances where possible.; Check TomatoCart or maintainer guidance for fixed versions or patches..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.