CVE-2009-1089: Absolute path traversal vulnerability in upload.php in Rapidleech rev.36 and earlier allows remote attacker...

Security readout for executives and security teams

CVE-2009-1089 is a remote file disclosure issue in Rapidleech rev.36 and earlier. A vulnerable upload.php can be tricked into reading arbitrary local files using a specially encoded filename value. Internet-facing deployments could expose configuration or other sensitive files. The supplied sources do not provide CVSS scoring or confirm active exploitation. Exposure is most likely where old Rapidleech rev.36 or earlier instances remain reachable over the network, especially public file-transfer or download-helper deployments. Modern exposure is uncertain because the product and version data in the bundle is limited. Treat this as high priority if Rapidleech is still deployed or internet-facing. Arbitrary file read can expose credentials and configuration, but urgency is lower when no Rapidleech assets are present and no active exploitation is evidenced in the supplied sources. Mitigation focus: Inventory and retire any Rapidleech rev.36 or earlier deployments.; Check current vendor or maintainer guidance before assuming a specific patch exists.; Restrict network access to any required legacy Rapidleech instance..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.