CVE-2009-2124: Directory traversal vulnerability in page.php in Elvin 1.2.0 allows remote attackers to include and execute...

Security readout for executives and security teams

CVE-2009-2124 is a directory traversal flaw in Elvin 1.2.0. A remote attacker could manipulate the page.php id parameter to include and execute local files. That can turn a web application flaw into server-side code execution depending on what local files are reachable. The source bundle does not name a fixed version or vendor patch. Exposure is limited to environments running Elvin 1.2.0 with page.php reachable by remote users. Public internet exposure would raise urgency. The provided affected-product metadata is incomplete, so asset owners should verify deployments by application name, version, and route presence. High priority for any confirmed exposed Elvin 1.2.0 instance. The business risk is unauthorized server-side file execution, but urgency depends on whether the obsolete application is still deployed and reachable. Mitigation focus: Identify and retire any Elvin 1.2.0 deployments.; Check vendor or maintainer guidance for a fixed release.; Restrict remote access to affected page.php routes where removal is not immediate..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.