CVE-2011-2772: The get_dataroot_image_path function in lib/file.php in Mahara before 1.4.1 does not properly validate uplo...

Security readout for executives and security teams

CVE-2011-2772 is a denial-of-service issue in Mahara before 1.4.1. A remote attacker could upload a very large or invalid image and trigger excessive memory consumption. The disclosed impact is availability, not data theft or code execution. Exposure is likely limited to Mahara deployments older than 1.4.1, especially where image upload paths are reachable by untrusted users. Debian-packaged Mahara installations should be checked against DSA-2334 guidance. Prioritize remediation for internet-facing or broadly accessible Mahara portals. The business risk is service disruption, with no source evidence of data compromise or code execution. Mitigation focus: Upgrade Mahara to 1.4.1 or a vendor-supported package containing the fix.; Apply Debian DSA-2334 package updates where Mahara is installed from Debian repositories.; Restrict unauthenticated or unnecessary image uploads until vendor guidance is applied..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.