CVE-2009-3825: Multiple directory traversal vulnerabilities in GenCMS 2006 allow remote attackers to include and execute a...

Security readout for executives and security teams

CVE-2009-3825 affects GenCMS 2006. A remote attacker could abuse directory traversal in specific page parameters to include and execute local files. For leaders, the main risk is any still-running legacy GenCMS instance exposed to the internet. The sources do not provide CVSS, a vendor fix, or evidence of active exploitation. Exposure is likely limited to organizations still operating GenCMS 2006 or hosting old copies of it. Risk is highest where the application is internet-facing and the affected PHP pages remain reachable. The source bundle does not identify other affected products or versions. Prioritize discovery and retirement of any exposed GenCMS 2006 instance. The issue is old, but the described impact is serious and public exploit information exists. If the platform is not present, business risk is negligible. Mitigation focus: Inventory for GenCMS 2006 instances, including forgotten legacy sites and admin paths.; Remove or isolate any exposed GenCMS 2006 deployment if it is no longer required.; Check vendor or maintainer guidance before assuming a patch exists..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.