CVE-2010-20120

published 2025-08-21

CVE-2010-20120: Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior…

Priority P3 50 high 8.4 CVSS 4.0

AV L AC L AT N PR N UI A VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior bypasses standard security restrictions that normally prevent code execution in regular Maple worksheets. The vulnerability enables attackers to craft malicious .maplet files that execute arbitrary code without user interaction.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
maplesoft	maple	<= 13	—

Detection & IOCs extracted from sources · hover to see the quote

filename .maplet↗

• → Monitor for the opening of .maplet files, especially those that trigger process creation or file writes, as the Maplet framework executes embedded commands automatically upon file open without user interaction. ↗
• → Alert on child processes spawned by the Maple application process, particularly when initiated by opening a .maplet file, as code execution occurs without user interaction. ↗

• · All Maple versions up to and including 13 are suspected vulnerable; testing was confirmed only on version 13 on Windows, so behavior on other platforms or versions may differ. ↗
• · The vulnerability is specific to the Maplet framework and does not affect standard Maple worksheets, which enforce security restrictions preventing automatic code execution. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94