Security readout for executives and security teams
Plain-English summary
BigTree CMS 4.2.22 and earlier allowed attackers to upload a special server configuration file through an admin tree upload path. That could make the server execute uploaded PHP code, turning a content-management upload weakness into possible server compromise.
Executive priority
Prioritize remediation where BigTree CMS hosts public-facing or business-critical content. The business risk is server compromise from a CMS upload path, but current sources do not confirm active exploitation.
Technical view
The issue is in BigTreeStorage in core/inc/bigtree/apis/storage.php. The CVE states that site/index.php/admin/trees/add/ did not prevent .htaccess uploads, enabling arbitrary PHP upload and execution in BigTree CMS 4.2.22 and earlier.
Likely exposure
Exposure is limited to organizations running BigTree CMS 4.2.22 or earlier, particularly deployments where the referenced admin tree upload route is reachable and upload storage is web-served by Apache-compatible configuration.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. Public GitHub issue and commit references exist, so defenders should assume the weakness is publicly known, but not treat active exploitation as confirmed.
Researcher notes
Evidence is strong for root cause and affected version ceiling, but incomplete for CVSS, CWE, authentication requirements, exact fixed release, and exploitation in the wild. Avoid assuming broader affected products beyond BigTree CMS 4.2.22 and earlier.
Mitigation direction
- Upgrade BigTree CMS according to vendor guidance or apply the referenced security commit.
- Ensure upload handling blocks .htaccess files and other server configuration files.
- Restrict access to administrative upload routes to trusted authenticated users and networks.
- Review web server settings so uploaded content cannot enable PHP execution.
- Monitor for unexpected .htaccess files in upload or storage directories.
Validation and detection
- Inventory BigTree CMS deployments and identify versions at or below 4.2.22.
- Confirm the BigTreeStorage code includes the vendor fix for .htaccess upload prevention.
- Inspect upload directories for unexpected .htaccess files or PHP execution-enabling settings.
- Review logs for suspicious activity against site/index.php/admin/trees/add/.
- Verify administrative routes are not publicly reachable beyond intended access controls.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-10574 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/bigtreecms/BigTree-CMS/issues/335CVE reference · x_refsource_CONFIRM
- https://github.com/bigtreecms/BigTree-CMS/commit/609bd17728ee1db0487a42d96028d30537528ae8CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.