CVE-2009-1405: Directory traversal vulnerability in index.php in PastelCMS 0.8.0, when magic_quotes_gpc is disabled, allow...

Security readout for executives and security teams

PastelCMS 0.8.0 has a directory traversal flaw in index.php. When PHP magic_quotes_gpc is disabled, a remote attacker may make the application include and execute local files through the set_lng parameter. That can turn a small CMS exposure into server compromise if vulnerable files are present. Exposure is likely limited to legacy PastelCMS 0.8.0 deployments reachable over HTTP, especially internet-facing sites running old PHP configurations. The bundle’s structured affected-product fields are incomplete, so asset discovery should key on application fingerprints and code review, not CPE alone. Prioritize this if PastelCMS is still exposed. The software and disclosure are old, but the described impact is serious and public exploit material is referenced. If no PastelCMS is present, business urgency is low after documenting the absence. Mitigation focus: Identify and inventory any PastelCMS 0.8.0 instances.; Check maintainer or archival vendor guidance for fixed releases or official workarounds.; Remove, replace, or isolate unsupported PastelCMS deployments..

Prepared

Jun 28, 2026, 11:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.