CVE-2009-4088

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-11-29 · updated 2026-06-16
Weakness: CWE-22

Description

Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 and earlier allow remote attackers to read arbitrary files via directory traversal sequences in the css parameter to (1) getjs.php and (2) getcsslocal.php; and include and execute arbitrary local files via the (3) group parameter to upload.php.

Affected products

Telepark.Wiki: through 2.4.23

References

http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/
http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt
http://secunia.com/advisories/37391
http://www.exploit-db.com/exploits/9483
http://www.osvdb.org/60216
http://www.osvdb.org/60217
http://www.osvdb.org/60218
https://exchange.xforce.ibmcloud.com/vulnerabilities/54327
http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/
http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt
http://secunia.com/advisories/37391
http://www.exploit-db.com/exploits/9483

Get alerted when CVE-2009-4088 or the next vulnerability affects your stack