Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary dir…

Published 17 y ago 2009-07-05 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.5

v2.0 · NVD

CISA KEV

not known exploited

EPSS

83.9%

percentile 100%

Public exploits

Metasploit · Exploit-DB

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.

Exploit prediction (EPSS)

83.86% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

Metasploit exploit/windows/http/coldfusion_fckeditor ColdFusion 8.0.1 Arbitrary File Upload and Execute · metasploit exploit, excellent rank · 2009-07-03
EDB-50057 Adobe ColdFusion 8 - Remote Command Execution (RCE) · webapps · 2021-06-24
EDB-16788 ColdFusion 8.0.1 - Arbitrary File Upload / Execution (Metasploit) · webapps · 2010-11-24

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

vupen.com /english/advisories/2009/1825 · vdb-entry, x_refsource_VUPEN, x_transferred
ocert.org /advisories/ocert-2009-007.html · x_refsource_MISC, x_transferred
sourceforge.net /project/shownotes.php?release_id=695430 · x_refsource_CONFIRM, x_transferred
secunia.com /advisories/35909 · third-party-advisory, x_refsource_SECUNIA, x_transferred
debian.org /security/2009/dsa-1836 · vendor-advisory, x_refsource_DEBIAN, x_transferred
redhat.com /archives/fedora-package-announce/2009-July/msg00710.html · vendor-advisory, x_refsource_FEDORA, x_transferred
secunia.com /advisories/35833 · third-party-advisory, x_refsource_SECUNIA, x_transferred
vupen.com /english/advisories/2009/1813 · vdb-entry, x_refsource_VUPEN, x_transferred
mail.zope.org /pipermail/zope-dev/2009-July/037195.html · mailing-list, x_refsource_MLIST, x_transferred
securitytracker.com /id?1022513 · vdb-entry, x_refsource_SECTRACK, x_transferred
isc.sans.org /diary.html?storyid=6724 · x_refsource_MISC, x_transferred
securityfocus.com /archive/1/504721/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
redhat.com /archives/fedora-package-announce/2009-July/msg00750.html · vendor-advisory, x_refsource_FEDORA, x_transferred
packetstormsecurity.com /files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2009-2265
NVD: CVE-2009-2265

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.