CVE-2009-2641: PHP remote file inclusion vulnerability in app_and_readme/navigator/index.php in School Data Navigator allo...

Security readout for executives and security teams

School Data Navigator had a PHP file-inclusion flaw in a navigator page. If the vulnerable file is exposed, an attacker could make the application load attacker-controlled PHP or local files, potentially leading to server compromise. The sources do not identify a vendor patch or supported affected versions. Exposure is likely limited to legacy School Data Navigator deployments where app_and_readme/navigator/index.php is reachable by untrusted users. Asset owners should not assume exposure without confirming the file and route exist. Prioritize discovery and containment for any internet-facing instance. The business risk is potentially severe because arbitrary PHP execution can become full web-server compromise, but confidence is constrained by sparse affected-version and remediation data. Mitigation focus: Check maintainer or vendor guidance for any fixed release or removal recommendation.; Remove or disable the vulnerable navigator component if it is not required.; Restrict access to the affected path to trusted administrative networks only..

Prepared

Jun 28, 2026, 10:26 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.