CVE-2004-1385: phpGroupWare 0.9.16.003 and earlier allows remote attackers to gain sensitive information via (1) unexpecte...

Security readout for executives and security teams

This is an older phpGroupWare path-disclosure issue. A remote attacker could cause error messages that reveal the server filesystem path. That information is not usually a breach by itself, but it can help attackers map the environment for follow-on attacks. Exposure is likely limited to organizations still running phpGroupWare 0.9.16.003 or earlier, especially if the application is internet-facing and displays detailed PHP or application errors to users. Treat this as a legacy exposure cleanup item. It is not evidenced as actively exploited, but any internet-facing obsolete phpGroupWare instance should be remediated or retired because path disclosure can aid broader compromise attempts. Mitigation focus: Inventory phpGroupWare deployments and identify versions 0.9.16.003 or earlier.; Review upstream, IBM X-Force, Bugtraq, GulfTech, and Gentoo GLSA guidance for fixed versions.; Restrict public access to legacy phpGroupWare instances until remediation is confirmed..

Prepared

Jun 30, 2026, 01:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.