CVE Feed

    Dashboard / CVE / CVE-2009-2265

    CVE-2009-2265

    Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.

    Published:Jul 3, 2009
    Last Modified:Apr 23, 2026
    EPS:Jul 5, 2009
    EPSS Score:0.92763
    CVSS Score:7.5

    Affected Products

    Vendor
    Fckeditor
    Product
    Fckeditor

    Exploits

    https://www.exploit-db.com/exploits/50057https://github.com/0xDTC/Adobe-ColdFusion-8-RCE-CVE-2009-2265https://github.com/h3x0v3rl0rd/CVE-2009-2265https://github.com/matesz44/CVE-2009-2265https://github.com/nika0x38/CVE-2009-2265https://github.com/p1ckzi/CVE-2009-2265https://github.com/zaphoxx/zaphoxx-coldfusionhttps://www.exploit-db.com/exploits/16788

    Related CVEs

    CVE-2009-2324 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inje…
    CVE-2008-6178 (CVSS 7.5) — Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in F…
    CVE-2006-6978 (CVSS 4.3) — Cross-site scripting (XSS) vulnerability in the "Basic Toolbar Selection" in FCKEditor allows remote attackers…
    CVE-2006-2529 (CVSS 5) — editor/filemanager/upload/php/upload.php in FCKeditor before 2.3 Beta, when the upload feature is enabled, doe…
    CVE-2006-0921 (CVSS 6.4) — Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as…
    CVE-2006-0658 (CVSS 5) — Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunC…
    CVE-2005-0613 (CVSS 5) — Unknown vulnerability in FCKeditor 2.0 RC2, when used with PHP-Nuke, allows remote attackers to upload arbitra…

    References

    http://isc.sans.org/diary.html?storyid=6724
    http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html
    http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html
    http://secunia.com/advisories/35833
    http://secunia.com/advisories/35909
    http://sourceforge.net/project/shownotes.php?release_id=695430
    http://www.debian.org/security/2009/dsa-1836
    http://www.ocert.org/advisories/ocert-2009-007.html
    http://www.securityfocus.com/archive/1/504721/100/0/threaded
    http://www.securitytracker.com/id?1022513
    http://www.vupen.com/english/advisories/2009/1813
    http://www.vupen.com/english/advisories/2009/1825
    https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html
    https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html
    http://isc.sans.org/diary.html?storyid=6724
    http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html
    http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html
    http://secunia.com/advisories/35833
    http://secunia.com/advisories/35909
    http://sourceforge.net/project/shownotes.php?release_id=695430
    http://www.debian.org/security/2009/dsa-1836
    http://www.ocert.org/advisories/ocert-2009-007.html
    http://www.securityfocus.com/archive/1/504721/100/0/threaded
    http://www.securitytracker.com/id?1022513
    http://www.vupen.com/english/advisories/2009/1813
    http://www.vupen.com/english/advisories/2009/1825
    https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html
    https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High