CVE-2009-4512: Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows...

Security readout for executives and security teams

CVE-2009-4512 affects Oscailt 3.3 sites using index.php with Friendly URLs disabled. A remote attacker could abuse path traversal in the obj_id parameter to make the application include and execute local files. That can threaten confidentiality and server integrity, but the source bundle does not provide CVSS, CPEs, or a vendor fix. Exposure is likely limited to internet-accessible Oscailt 3.3 deployments where Use Friendly URLs is disabled. The bundle’s affected-product metadata is incomplete, so asset owners should confirm product name, version, and configuration from installed files and application settings. Prioritize finding and removing exposed Oscailt 3.3 instances, especially public websites. The vulnerability is old and has public exploit references, but active exploitation is not established in the supplied sources. Mitigation focus: Check vendor and historical advisory guidance for an official fixed version or configuration change.; Remove or upgrade any remaining Oscailt 3.3 deployment if vendor guidance cannot be confirmed.; Avoid exposing affected index.php instances to the public internet until remediated..

Prepared

Jun 28, 2026, 09:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.