CVE-2009-2176: Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.03a and earlier, when magic_quotes_gpc is...

Security readout for executives and security teams

CVE-2009-2176 affects old fuzzylime CMS releases, 3.03a and earlier. If a site runs this CMS with magic_quotes_gpc disabled, a remote attacker may abuse file path handling to include and execute local files through two PHP scripts. Exposure is likely limited to legacy installations, but impact could be serious where present. Internet-facing legacy fuzzylime CMS 3.03a or earlier installations are the main concern, especially if running vulnerable PHP scripts with magic_quotes_gpc disabled. Modern environments are unlikely to use this CMS, but forgotten small sites, archived applications, and unmanaged web roots may still expose it. Prioritize this if any public-facing fuzzylime CMS instance exists. The business risk is concentrated but potentially severe: a small legacy CMS exposure could allow server-side file inclusion and code execution behavior. If no installations are found, residual risk is low. Mitigation focus: Identify any fuzzylime CMS installations and confirm exact version.; If 3.03a or earlier is present, check vendor guidance for fixed versions or advisories.; Restrict public access to code/confirm.php and code/display.php until remediated..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.