CVE-2007-0849: scripts/cronscript.php in SysCP 1.2.15 and earlier does not properly quote pathnames in user home directori...

Security readout for executives and security teams

This flaw affects SysCP installations described as version 1.2.15 and earlier. A local hosting user could abuse unsafe handling of directory names in a cron script to gain higher privileges. The business risk is highest on shared hosting or multi-user systems where untrusted users can manage protected directories. Exposure is likely limited to legacy SysCP deployments, especially shared hosting environments with local or panel-authenticated users. The bundle names SysCP 1.2.15 and earlier, but affected CPE data is absent. Treat as high priority only where legacy SysCP is still present. The vulnerability can turn limited local access into elevated privileges, but it is old and exposure should be rare in modern environments. Mitigation focus: Identify and retire or upgrade any SysCP 1.2.15 or earlier installations.; Check vendor advisory material for the specific fixed version or configuration guidance.; Restrict directory-protection features to trusted administrators until remediation is confirmed..

Prepared

Jun 29, 2026, 07:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.