CVE-2009-4449

🗓️ 29 Dec 2009 20:15:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 61 Views🌐 WEB

Directory traversal vulnerability in MyBB 1.4.10 allows remote authenticated users to determine file existence via avatar/gallery parameters

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2009-4449	29 Dec 200920:15	–	cvelist
Mend	CVE-2009-4449	29 Dec 200920:15	–	mend
NVD	CVE-2009-4449	29 Dec 200920:41	–	nvd
Prion	Directory traversal	29 Dec 200920:41	–	prion
Positive Technologies	PT-2009-6570 · Mybb · Mybb	29 Dec 200900:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2009-4449: Improper Limitation of a Pathname to a Restricted Directory	29 Dec 200900:00	–	rapid7

NVD

Node

mybb mybbMatch1.4.10

Source	Link
dev	www.dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.php
dev	www.dev.mybboard.net/issues/617
vupen	www.vupen.com/english/advisories/2009/3651
securityfocus	www.securityfocus.com/bid/37489
secunia	www.secunia.com/advisories/37906
openwall	www.openwall.com/lists/oss-security/2010/10/08/7
dev	www.dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.php
blog	www.blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/
osvdb	www.osvdb.org/61359
openwall	www.openwall.com/lists/oss-security/2010/12/06/2

Parameter	Position	Path	Description	CWE
avatar	request body	admin/modules/user/users.php	Directory traversal vulnerability allowing authenticated users to determine file existence via traversal sequences in avatar and possibly gallery parameters during avatar change.	CWE-22
gallery	request body	admin/modules/user/users.php	Directory traversal vulnerability allowing authenticated users to determine file existence via traversal sequences in avatar and possibly gallery parameters during avatar change.	CWE-22
avatar	request body	usercp.php	Directory traversal vulnerability allowing authenticated users to determine file existence via traversal sequences in avatar and possibly gallery parameters during avatar change.	CWE-22
gallery	request body	usercp.php	Directory traversal vulnerability allowing authenticated users to determine file existence via traversal sequences in avatar and possibly gallery parameters during avatar change.	CWE-22

16 Jun 2026 23:13Current

6.3Medium risk

Vulners AI Score6.3

CVSS 26.3

CVSS 3.16.5

EPSS0.02698