CVE-2009-2265

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 83.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-07-05 · updated 2026-06-16
Weakness: CWE-22

Description

Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.

Affected products

Fckeditor: through 2.6.4; 2.0, 2.0_fc, 2.0_rc2, 2.0rc2, 2.0rc3, 2.1 (+20)

References

http://isc.sans.org/diary.html?storyid=6724
http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html
http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html
http://secunia.com/advisories/35833
http://secunia.com/advisories/35909
http://sourceforge.net/project/shownotes.php?release_id=695430
http://www.debian.org/security/2009/dsa-1836
http://www.ocert.org/advisories/ocert-2009-007.html
http://www.securityfocus.com/archive/1/504721/100/0/threaded
http://www.securitytracker.com/id?1022513
http://www.vupen.com/english/advisories/2009/1813
http://www.vupen.com/english/advisories/2009/1825

Get alerted when CVE-2009-2265 or the next vulnerability affects your stack