CVE-2009-4025: Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package...

Security readout for executives and security teams

CVE-2009-4025 affects the PEAR Net_Traceroute PHP package before 0.21.2. If an application passes attacker-controlled input into its traceroute host parameter, an attacker may execute shell commands on the server. Business urgency depends on whether legacy PHP applications still use this package and expose traceroute functionality to users. Exposure is most likely in legacy PHP applications using PEAR Net_Traceroute before 0.21.2, especially where user-supplied hostnames or IPs reach traceroute functionality. Systems using distro packages from 2009-era Fedora or Gentoo should verify their update status. Prioritize if internet-facing or internal tools expose traceroute-like diagnostics and run legacy PHP dependencies. Otherwise, handle through legacy dependency cleanup. The impact can be severe, but exposure is conditional and no active exploitation is cited. Mitigation focus: Upgrade PEAR Net_Traceroute to version 0.21.2 or later.; Apply relevant Fedora or Gentoo package updates where distro packages are used.; Restrict traceroute features from accepting untrusted user input until updated..

Prepared

Jun 28, 2026, 13:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.