CVE-2008-6807: PHP remote file inclusion vulnerability in ListRecords.php in osprey 1.0a4.1 allows remote attackers to exe...

Security readout for executives and security teams

CVE-2008-6807 describes a remote file inclusion issue in Osprey 1.0a4.1. If a vulnerable ListRecords.php file is reachable, an attacker may be able to make the server run attacker-controlled PHP code through the xml_dir parameter. Public data is sparse and provenance is explicitly uncertain. Exposure appears limited to legacy Osprey 1.0a4.1 installations where ListRecords.php is deployed and reachable, especially from the internet. The CVE record does not provide CPEs or a reliable affected-product inventory, so confirmation requires local asset review. Treat this as a legacy application exposure question rather than a broad enterprise emergency. If Osprey 1.0a4.1 is internet-facing, prioritize containment or retirement because the reported impact is server-side code execution. Mitigation focus: Identify any deployed Osprey 1.0a4.1 instances and ListRecords.php files.; Check vendor or maintainer guidance before assuming a fixed version exists.; Remove or disable unsupported Osprey deployments where business use is no longer required..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.