Which products and versions are affected by CVE-2013-0136?

Affected: Mutiny versions 5.0-1.00; Mutiny Virtual Appliance; Mutiny Appliance. The full list is in the CVE brief.

Is CVE-2013-0136 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2013-0136 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2013-0136?

Public exploit code is available.

Is there a fix for CVE-2013-0136?

Fixed versions are available, including Mutiny 5.0-1.10.

How urgently should CVE-2013-0136 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

Emerging threatsHigh

CVE-2013-0136Mutiny Path Traversal

Published Jun 1, 2013 · Updated Apr 28, 2026

Key Facts

Patch immediately

CVE-2013-0136 is a high-severity vulnerability (CVSS 8.5 v2) affecting Mutiny, Mutiny Virtual Appliance, Mutiny Appliance.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 40% probability of exploitation in the next 30 days.
Fixed versions are available, including Mutiny 5.0-1.10.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v2

8.5

AV:N/AC:M/Au:S/C:C/I:C/A:C

EPSS (30-day exploit likelihood)

40%

Higher than 98.6% of all scored CVEs

Exploit maturity

Weaponized

ATLAS score

52/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Weaponized

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Description

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.

Affected Products

4 affected entries in total

Product	Affected versions	Fixed in
MutinyMutiny	5.0-1.00	5.0-1.10
Mutiny Virtual ApplianceMutiny	See advisory	n/a
Mutiny ApplianceMutiny	See advisory	n/a

Patched Releases

Mutiny

5.0-1.10

Timeline

Publicly disclosed
Jun 1, 2013
Last updated
Apr 28, 2026

Weakness Type

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References

exploitcommunity.rapid7.com · new-1day-exploits-mutiny-vulnerabilities
exploitMSF mutiny_frontend_upload.rb
exploitExploitDB-25517
otherVU#701572

FAQ

Common Questions.

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD oper…
Affected: Mutiny versions 5.0-1.00; Mutiny Virtual Appliance; Mutiny Appliance. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Mutiny 5.0-1.10.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2013-0136 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.