CVE-2009-4116: Multiple directory traversal vulnerabilities in CutePHP CuteNews 1.4.6, when magic_quotes_gpc is disabled,...

Security readout for executives and security teams

CVE-2009-4116 affects CutePHP CuteNews 1.4.6 when PHP magic_quotes_gpc is disabled. Authenticated editor or administrator users can abuse directory traversal to read files. One Options-module path can also lead to local file inclusion and code execution. Risk is mainly for legacy installations that still expose CuteNews administrative functions. Exposure is likely limited to organizations still running CuteNews 1.4.6, especially internet-facing or broadly accessible admin panels. Exploitation requires valid editor or administrative application access and magic_quotes_gpc disabled. Modern environments may not have this software, but legacy PHP/CMS deployments should be checked. Prioritize if CuteNews 1.4.6 is present on any active site, especially internet-facing systems. The issue can expose sensitive files and may enable code execution after authenticated access. If the product is no longer business-critical, retirement is the safest path. Mitigation focus: Identify and remove or isolate legacy CuteNews 1.4.6 deployments.; Check CutePHP or trusted vendor guidance for supported upgrade or remediation paths.; Restrict CuteNews editor and administrator access to trusted users only..

Prepared

Jun 28, 2026, 12:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.