CVE-2010-3468: Directory traversal vulnerability in fileManager.cfc in Mura CMS 5.1 before 5.1.498 and 5.2 before 5.2.2809...

Security readout for executives and security teams

Older Mura CMS and Sava CMS versions exposed a file download route that could let a remote attacker read files outside the intended directory. For executives, the risk is disclosure of sensitive server files from legacy web systems. The source bundle does not provide a CVSS score or evidence of active exploitation. Exposure is most likely on internet-facing legacy Mura or Sava CMS deployments that still expose the default tasks/render/file/ URI. The bundle lists no CPEs, so asset discovery must rely on product/version inventory and route checks. Treat as high priority for any legacy CMS still reachable from the internet. Arbitrary file read can expose credentials, configuration, or sensitive content, but urgency should be scoped to confirmed Mura or Sava deployments. Mitigation focus: Upgrade Mura CMS to 5.1.498, 5.2.2809, or a supported current release.; Review the Mura critical security patch guidance from the vendor.; Identify Sava CMS 5 through 5.2 installations and check vendor guidance..

Prepared

Jun 28, 2026, 01:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.