CVE-2008-5965: Directory traversal vulnerability in index.php in LokiCMS 0.3.4 and earlier, when magic_quotes_gpc is disab...

Security readout for executives and security teams

CVE-2008-5965 affects LokiCMS 0.3.4 and earlier when PHP magic_quotes_gpc is disabled. A remote attacker can use the page parameter to test whether arbitrary files exist on the server. The sources describe file existence checking, not confirmed file disclosure or code execution. Exposure is likely limited to internet-accessible LokiCMS 0.3.4 or earlier deployments with magic_quotes_gpc disabled. LokiCMS appears legacy, so the main risk is forgotten or unmaintained installations. Treat as a legacy exposure cleanup item with moderate urgency. It is not described as actively exploited, but public exploit information and remote reachability make exposed systems worth finding and retiring promptly. Mitigation focus: Inventory public web servers for LokiCMS 0.3.4 or earlier.; Check vendor or maintainer guidance for a fixed release or retirement path.; Remove or replace unsupported LokiCMS deployments where feasible..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.