CVE-2020-37012
Published: 29 January 2026
Description
Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's…
more
tex2png API action.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates command injection (CWE-78) by validating LaTeX payloads for illicit shell commands before processing in the tex2png API action.
Remediates the specific flaw in the /api.php tex2png endpoint to eliminate arbitrary shell command execution.
Enforces boundary protection at network interfaces to filter and block malicious LaTeX payloads targeting the unauthenticated endpoint.
Security SummaryAI
CVE-2020-37012 is a remote code execution vulnerability in Tea LaTeX 1.0. The flaw resides in the /api.php endpoint, specifically the tex2png API action, which processes crafted malicious LaTeX payloads containing shell commands, resulting in arbitrary command execution. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
Unauthenticated remote attackers can exploit this vulnerability with low complexity and no privileges or user interaction required. By sending a specially crafted LaTeX payload to the vulnerable endpoint, attackers achieve execution of arbitrary shell commands on the server, enabling full system compromise with high impacts to confidentiality, integrity, and availability.
Advisories and references, including the Vulncheck advisory at https://www.vulncheck.com/advisories/tea-latex-remote-code-execution and Exploit-DB entries at https://www.exploit-db.com/exploits/48805, document the issue and provide exploit details; the GitHub repository at https://github.com/ammarfaizi2/latex.teainside.org offers source context for affected Tea LaTeX 1.0.
A public proof-of-concept exploit is available on Exploit-DB, highlighting active exploit development.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables unauthenticated RCE via command injection in a public-facing web API (/api.php), directly mapping to T1190 (Exploit Public-Facing Application) and facilitating arbitrary Unix shell command execution (T1059.004).