CVE-2018-10574: Bigtreecms Bigtree CMS

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files.

Affected products

• Bigtreecms Bigtree CMS: up to and including 4.2.22

Published 2018-04-30. Last modified 2026-06-17.