CVE-2009-4614: Multiple PHP remote file inclusion vulnerabilities in Moa Gallery 1.2.0 and earlier allow remote attackers...

Security readout for executives and security teams

Moa Gallery 1.2.0 and earlier has multiple remote file inclusion flaws. If a vulnerable installation is exposed, an attacker may be able to make the PHP application load attacker-controlled code, leading to server-side code execution. The sources do not identify a vendor patch or current exploitation. Exposure is most likely limited to legacy internet-facing Moa Gallery deployments running version 1.2.0 or earlier, especially where PHP source paths are directly reachable. Modern environments are unlikely affected unless the application remains installed or archived in a web-accessible directory. Treat this as high priority only if Moa Gallery is present and reachable. The business risk is full compromise of an affected legacy PHP site, but the likely footprint is narrow and old. Mitigation focus: Identify and remove unsupported Moa Gallery installations where possible.; Check vendor or archival project guidance for any fixed release or official workaround.; Restrict public access to legacy Moa Gallery paths until remediation is complete..

Prepared

Jun 28, 2026, 03:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.