CVE-2008-4645: plugins/event_tracer/event_list.php in PhpWebGallery 1.7.2 and earlier allows remote authenticated administ...

Security readout for executives and security teams

CVE-2008-4645 is a legacy PhpWebGallery issue where an authenticated administrator could trigger arbitrary PHP execution through the event_tracer plugin. The business risk is mainly for old, still-running installations, especially if administrator accounts or the admin interface are exposed. Exposure is likely limited to organizations still running PhpWebGallery 1.7.2 or earlier with the event_tracer plugin present and administrator access reachable. The bundle does not identify affected CPEs or modern product lineage. Treat this as a legacy exposure cleanup item with high impact if present. Prioritize discovery and retirement or isolation of affected installations over emergency response, unless an exposed legacy admin portal is found. Mitigation focus: Inventory any PhpWebGallery 1.7.2 or earlier installations.; Check vendor or project guidance for fixed versions or supported migration paths.; Restrict administrator access to trusted networks and accounts only..

Prepared

Jun 28, 2026, 11:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.