CVE-2009-5067: Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files v...

Security readout for executives and security teams

CVE-2009-5067 is an old html2ps file disclosure issue. If html2ps before 1.0b6 processes attacker-controlled SSI include input, it may read files outside the intended path. The sources stress this is only a vulnerability in limited scenarios, especially web applications invoking html2ps. Exposure is most likely where a web application or document conversion workflow invokes html2ps on untrusted or user-supplied input. Systems using html2ps only for trusted local conversions have much lower practical exposure. Prioritize if html2ps is reachable through public or partner-facing conversion features. Otherwise, treat as a targeted legacy cleanup item during dependency and server hardening work. Mitigation focus: Identify any html2ps deployments and their versions.; Upgrade html2ps to 1.0b6 or later, or a vendor-fixed package.; Avoid processing untrusted SSI include content through html2ps..

Prepared

Jun 27, 2026, 16:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.