CVE-2008-4740: Directory traversal vulnerability in templater.php in the ZZ_Templater module in TinyCMS 1.1.2, when regist...

Security readout for executives and security teams

CVE-2008-4740 affects the ZZ_Templater module in TinyCMS 1.1.2. Under specific legacy PHP settings, a remote attacker could make the application load local files outside the intended template directory, potentially leading to code execution. This is mainly a legacy-software exposure issue, but internet-facing affected instances should be treated seriously. Exposure is likely limited to legacy TinyCMS 1.1.2 deployments using the ZZ_Templater module with the specified PHP configuration. Internet-facing systems are the main concern. Modernized or unsupported migrations may still carry copied vulnerable code, so source and asset inventory matter. Prioritize if TinyCMS 1.1.2 is still exposed to the internet or used in business-critical environments. The product age and public exploit reference make replacement or isolation more practical than prolonged risk acceptance. Mitigation focus: Identify and retire or isolate TinyCMS 1.1.2 instances.; Check vendor or archived advisory guidance for an official fix.; Disable register_globals where technically possible..

Prepared

Jun 28, 2026, 11:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.