CVE-2012-5192: Bitweaver view_overlay.php directory traversal file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote file read with public exploit references and very high EPSS, though impact is confidentiality-only and no KEV listing exists.

What it is

Bitweaver 2.8.1 and earlier contains a directory traversal flaw in gmap/view_overlay.php. The overlay_type parameter accepts encoded dot-dot-slash sequences, letting a remote attacker read files outside the intended directory. The record is thin: no patch version or fixed release is named.

Impact

An unauthenticated attacker can read arbitrary files on the server, potentially exposing configuration files, credentials or other sensitive data. There is no write or code execution impact in the supplied data.

Attack surface

Reachable over the network through HTTP requests to gmap/view_overlay.php with a crafted overlay_type parameter. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.52477 (99th percentile) and both references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor fix for Bitweaver if one is available; the record does not name a patched version, so confirm with the vendor.
• If no patch exists, remove or disable gmap/view_overlay.php or block access to it at the web server.
• Validate and reject traversal sequences in overlay_type, and resolve file paths against a strict allowlist.
• Run Bitweaver with least privilege and restrict readable files via filesystem permissions.
• Place the application behind a WAF rule that blocks encoded dot-dot-slash patterns in request parameters.

Detection

• Search web logs for requests to gmap/view_overlay.php containing %2F, .. or encoded traversal sequences in overlay_type.
• Alert on HTTP 200 responses to overlay_type values that resolve outside the expected gmap directory.
• Monitor for repeated file-read attempts from a single source against view_overlay.php.
• Review filesystem access logs for reads of sensitive files by the web server user.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.