CVE-2004-2575: phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct req...

Security readout for executives and security teams

This old phpGroupWare issue can disclose the server file path through error messages when certain application files are accessed directly. That usually does not give an attacker control, but it can reveal environment details useful for further attacks. The source bundle provides no CVSS score, patch detail, or evidence of active exploitation. Exposure is likely limited to internet-reachable phpGroupWare deployments at version 0.9.14.005 or earlier where the named files remain web-accessible and error messages expose local paths. Treat this as a low-blast-radius legacy exposure unless the affected application is business-critical or internet-facing. The main urgency is finding old phpGroupWare installations and preventing information leakage that could support broader intrusion attempts. Mitigation focus: Identify and prioritize any phpGroupWare 0.9.14.005 or earlier deployments.; Check official phpGroupWare or GNU Savannah guidance for fixed versions or configuration guidance.; Restrict direct web access to internal include and setup sample files..

Prepared

Jun 29, 2026, 16:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.