CVE-2020-37012

CriticalPublic PoCRCE

Published: 29 January 2026

Published

29 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v4 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0076 50.3th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2020-37012 is a critical-severity OS Command Injection (CWE-78) vulnerability. Its CVSS base score is 9.3 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2020-37012 is a remote code execution vulnerability in Tea LaTeX 1.0. The flaw resides in the /api.php endpoint, specifically the tex2png API action, which processes crafted malicious LaTeX payloads containing shell commands, resulting in arbitrary command execution. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Unauthenticated remote attackers can exploit this vulnerability with low complexity and no privileges or user interaction required. By sending a specially crafted LaTeX payload to the vulnerable endpoint, attackers achieve execution of arbitrary shell commands on the server, enabling full system compromise with high impacts to confidentiality, integrity, and availability.

Advisories and references, including the Vulncheck advisory at https://www.vulncheck.com/advisories/tea-latex-remote-code-execution and Exploit-DB entries at https://www.exploit-db.com/exploits/48805, document the issue and provide exploit details; the GitHub repository at https://github.com/ammarfaizi2/latex.teainside.org offers source context for affected Tea LaTeX 1.0.

A public proof-of-concept exploit is available on Exploit-DB, highlighting active exploit development.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2020-30907

Vulnerability details

Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's…

tex2png API action.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

CVE enables unauthenticated RCE via command injection in a public-facing web API (/api.php), directly mapping to T1190 (Exploit Public-Facing Application) and facilitating arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0