CVE-2008-2913: Directory traversal vulnerability in func.php in Devalcms 1.4a, when magic_quotes_gpc is disabled, allows r...

Security readout for executives and security teams

This is an old Devalcms 1.4a directory traversal and local file inclusion issue. If a vulnerable site is exposed and the PHP magic_quotes_gpc setting is disabled, a remote attacker may cause the application to include and execute local files. The provided sources do not identify a vendor patch or current active exploitation. Exposure is likely limited to legacy Devalcms 1.4a deployments, especially internet-facing instances running affected PHP behavior with magic_quotes_gpc disabled. The bundled affected-product metadata is incomplete, so asset confirmation must rely on application inventory and source review. Treat confirmed internet-facing Devalcms 1.4a as urgent legacy risk. The business decision is likely replacement or isolation, because the bundle does not name a patch and the software appears obsolete. Mitigation focus: Identify and retire or replace any Devalcms 1.4a deployments.; Check archived vendor or maintainer guidance for an official fix.; Restrict public access to legacy Devalcms instances until remediated..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.