CVE-2007-1849: Directory traversal vulnerability in 404.php in Drake CMS allows remote attackers to include and execute ar...

Security readout for executives and security teams

CVE-2007-1849 describes a directory traversal flaw in Drake CMS 404.php. A remote attacker could use the d_private parameter to make the application include and execute local files. The record notes some details came from third parties and that Drake CMS was only beta, so exposure should be confirmed before broad remediation. Likely limited to organizations that deployed Drake CMS beta-era code publicly. The source bundle does not identify affected versions or CPEs, so exposure requires asset inventory and code verification rather than version matching alone. Treat as high priority only where Drake CMS is present and exposed. The impact could be serious, but the product appears old and beta-only, and the supplied sources do not prove broad current exposure or active exploitation. Mitigation focus: Check vendor or project guidance for any archived fix or replacement recommendation.; Remove or isolate any public Drake CMS beta deployment if business use is not required.; Restrict external access to affected Drake CMS paths while investigating exposure..

Prepared

Jun 29, 2026, 06:24 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.