CVE-2009-4896: Multiple directory traversal vulnerabilities in the mlmmj-php-admin web interface for Mailing List Managing...

Security readout for executives and security teams

CVE-2009-4896 affects the mlmmj-php-admin web interface in mlmmj 1.2.15 through 1.2.17. An authenticated remote user could use a crafted mailing-list name to access paths outside the intended list area, potentially creating, overwriting, or deleting files. This is most urgent where the admin interface is reachable by untrusted or broadly provisioned users. Exposure is likely limited to systems running mlmmj 1.2.15 through 1.2.17 with the php-admin web interface enabled and reachable. The attacker must authenticate, based on the CVE description. Prioritize remediation where the interface is internet-facing, shared with many administrators, or runs with broad filesystem permissions. Treat this as an integrity risk rather than a confirmed mass-exploitation emergency. Mitigation focus: Identify any mlmmj 1.2.15 through 1.2.17 deployments.; Check mlmmj and distribution advisories, including Debian DSA-2073, for corrected packages.; Restrict mlmmj-php-admin access to trusted administrative users only..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.