Multiple directory traversal vulnerabilities in Aperto Blog 0.1.1 allow remote attackers to include and execute arbitrary local files via d…

Published 17 y ago 2008-12-30 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.5

v2.0 · NVD

CISA KEV

not known exploited

EPSS

2.3%

percentile 83%

Public exploits

Exploit-DB

Multiple directory traversal vulnerabilities in Aperto Blog 0.1.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the (1) action parameter to admin.php and the (2) get parameter to index.php. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.

Exploit prediction (EPSS)

2.28% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

Exploits and detections

EDB-7482 Aperto Blog 0.1.1 - Local File Inclusion / SQL Injection · webapps · 2008-12-15

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

exploit-db.com /exploits/7482 · exploit, x_refsource_EXPLOIT-DB, x_transferred
securityfocus.com /bid/32850 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2008-5776
NVD: CVE-2008-5776

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.