CVE-2009-2109: Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files...

Security readout for executives and security teams

FretsWeb 1.2 has directory traversal flaws that can let a remote attacker read files the web server can access by abusing language selection inputs. For an organization still hosting this old application, the main business risk is confidential local file disclosure. The source bundle does not provide CVSS, named patch details, or evidence of active exploitation. Exposure is likely limited to internet-facing or internally reachable FretsWeb 1.2 installations. The bundle’s affected-product metadata is incomplete, so validate against application inventory rather than relying on CPE matching. Treat as high priority if FretsWeb 1.2 is deployed, especially on an internet-facing server. The issue can expose local files, and public exploit information is referenced, but urgency depends on whether the legacy application is actually present and reachable. Mitigation focus: Identify and decommission any exposed FretsWeb 1.2 instances if no longer needed.; Check vendor or project guidance for a fixed version or official workaround.; Restrict network access to trusted administrators until remediation is confirmed..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.