CVE-2008-3164: Directory traversal vulnerability in blog.php in fuzzylime (cms) 3.01, when magic_quotes_gpc is disabled, a...

Security readout for executives and security teams

An old fuzzylime (cms) issue lets a remote attacker make the blog component load unintended local files when a legacy PHP setting is disabled. If an exposed site still runs affected versions, compromise risk is serious. The sources do not provide CVSS, a vendor fix, or evidence of active exploitation. Exposure is likely limited to legacy public websites still running fuzzylime (cms) 3.01 or 3.01a with the vulnerable blog.php reachable. Asset inventories may miss this because the source bundle has no CPE data or normalized vendor/product metadata. Prioritize any internet-facing affected site for rapid containment or retirement. Although this is a 2008 vulnerability with no active exploitation evidence in the bundle, public exploit references and potential code execution make unmanaged legacy exposure unacceptable. Mitigation focus: Identify any fuzzylime (cms) 3.01 or 3.01a deployments.; Restrict public access to affected blog.php until remediation is confirmed.; Check vendor or archival project guidance for a fixed release or retirement path..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.