CVE-2009-4426: Multiple directory traversal vulnerabilities in Ignition 1.2, when magic_quotes_gpc is disabled, allow remo...

Security readout for executives and security teams

CVE-2009-4426 affects Ignition 1.2 under a specific legacy PHP configuration. A remote attacker could abuse path traversal in a request parameter to make the application include and execute local files. This is most concerning for old, internet-facing installations that were never retired or patched. Exposure is likely limited to legacy Ignition 1.2 deployments, especially public sites running old PHP configurations with magic_quotes_gpc disabled and affected scripts reachable. Treat as high priority only where Ignition 1.2 is present. The issue is old, but exposed legacy software can create disproportionate risk because public exploit references exist and patch status is unclear in the provided sources. Mitigation focus: Identify and retire or isolate any Ignition 1.2 installations.; Check vendor or maintainer guidance for fixed versions or replacement paths.; Restrict public access to affected scripts until remediation is complete..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.