CVE-2009-4113: Static code injection vulnerability in the Categories module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews b...

Security readout for executives and security teams

CVE-2009-4113 affects CutePHP CuteNews Categories functionality. An authenticated application administrator could place PHP code through the Category Access field, causing code to be stored in a server-side category database file. This is most urgent where CuteNews is still internet-facing or where administrator accounts are shared, delegated, or weakly protected. Exposure is likely limited to legacy CuteNews deployments, especially public sites still running CuteNews 1.4.6 or UTF-8 CuteNews before 8b. Risk increases if administrative access is available to multiple users or protected only by weak credentials. Treat as a targeted legacy-platform risk. It is not documented as actively exploited in the provided sources, but compromise of an admin account could turn a content-management feature into server-side code execution. Prioritize discovery and removal or upgrade of exposed legacy CuteNews systems. Mitigation focus: Identify any CuteNews or UTF-8 CuteNews installations and versions.; Upgrade UTF-8 CuteNews to 8b or later where applicable.; For CuteNews 1.4.6, check vendor or project guidance before applying changes..

Prepared

Jun 28, 2026, 12:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.