CVE-2009-0841

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-03-31 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.

Affected products

MapServer: 4.2.0-beta1, 4.4.0, 4.4.0-beta1, 4.4.0-beta2, 4.4.0-beta3, 4.6.0 (+33)
Umn Mapserver: 4.0, 4.0-beta1, 4.0-beta2

References

http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html
http://secunia.com/advisories/34520
http://secunia.com/advisories/34603
http://trac.osgeo.org/mapserver/ticket/2942
http://www.debian.org/security/2009/dsa-1914
http://www.positronsecurity.com/advisories/2009-000.html
http://www.securityfocus.com/archive/1/502271/100/0/threaded
http://www.securityfocus.com/bid/34306
http://www.securitytracker.com/id?1021952
https://exchange.xforce.ibmcloud.com/vulnerabilities/49548
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00147.html
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00170.html

Get alerted when CVE-2009-0841 or the next vulnerability affects your stack