Description
Tea LaTex 1.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary shell commands through the /api.php endpoint. Attackers can craft a malicious LaTeX payload with shell commands that are executed when processed by the application's tex2png API action.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ammarfaizi2 | Tea LaTex | 1.0 | — |
References
- ExploitDB-48805 exploit
- Vendor Homepage product
- VulnCheck Advisory: Tea LaTex 1.0 - Remote Code Execution third-party-advisory