CVE-2009-0572: PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS (aka Flatnuke3) 2009-01-27 an...

Security readout for executives and security teams

CVE-2009-0572 affects old FlatnuX CMS releases. Under specific unsafe PHP settings, an attacker could make the site include remote PHP code, leading to arbitrary code execution. This is mainly a legacy-platform risk, but exposed internet-facing installations should be treated seriously. Likely exposure is limited to legacy FlatnuX CMS deployments running the named 2009 releases with vulnerable PHP configuration. Modern environments are less likely to match these settings, but abandoned or forgotten PHP sites remain plausible exposure points. Prioritize urgently if any internet-facing FlatnuX instance exists. For organizations without this legacy CMS, this is a low practical priority after inventory confirms non-exposure. Mitigation focus: Identify and decommission or replace exposed FlatnuX CMS installations where possible.; Disable register_globals on any PHP environment still supporting it.; Restrict access to affected FlatnuX admin or file-management paths if retained..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.