CVE-2004-2009: NukeJokes 1.7 and 2 Beta allows remote attackers to obtain the full path of the server via (1) a direct cal...

Security readout for executives and security teams

This is an old information disclosure issue in the NukeJokes module for PhpNuke. A remote user can trigger PHP error output that reveals the server filesystem path. That does not directly grant access, but it can help attackers map the environment for later attacks. Exposure is most likely on legacy PhpNuke deployments that still run NukeJokes 1.7 or 2 Beta. Modern exposure is uncertain from the provided sources because affected CPEs and maintained vendor guidance are not listed. Treat this as a low-priority legacy exposure unless the module is internet-facing on a sensitive system. The main business risk is environmental information leakage that may support broader attacks against outdated PHP applications. Mitigation focus: Inventory legacy PhpNuke sites for the NukeJokes module and version.; Remove or disable NukeJokes if it is no longer required.; Check the original advisory or vendor guidance for any available fixed version..

Prepared

Jun 29, 2026, 21:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.