Vulnerability Report

CVE-2009-2265

RCE

Title: Fckeditor RCE

Arbitrary File Access

Proof Of Concept

PoC Available for CVE-2009-2265

CWE Category CWE-22
Published Date Jul 05, 2009
Modified Date Jun 16, 2026
Exploit Status Available
Score 7.5 CVSS v2.0
Exploit Probability (EPSS)
83.74%

Vulnerability Summary

CVE-2009-2265: Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.

Impacted Vendors

F
fckeditor 1
F
frederico_caldeira_knabben 1

Reference Links

http://isc.sans.org/diary.html?storyid=6724 http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html http://secunia.com/advisories/35833 http://secunia.com/advisories/35909 http://sourceforge.net/project/shownotes.php?release_id=695430 http://www.debian.org/security/2009/dsa-1836 http://www.ocert.org/advisories/ocert-2009-007.html http://www.securityfocus.com/archive/1/504721/100/0/threaded http://www.securitytracker.com/id?1022513 http://www.vupen.com/english/advisories/2009/1813 http://www.vupen.com/english/advisories/2009/1825 https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html http://isc.sans.org/diary.html?storyid=6724 http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html http://secunia.com/advisories/35833 http://secunia.com/advisories/35909 http://sourceforge.net/project/shownotes.php?release_id=695430 http://www.debian.org/security/2009/dsa-1836 http://www.ocert.org/advisories/ocert-2009-007.html http://www.securityfocus.com/archive/1/504721/100/0/threaded http://www.securitytracker.com/id?1022513 http://www.vupen.com/english/advisories/2009/1813 http://www.vupen.com/english/advisories/2009/1825 https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html
CVSS v2.0
Source Entity [email protected]
Severity HIGH
7.5
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2009-2265 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/zaphoxx/zaphoxx-coldfusion
View Code
GitHub https://github.com/p1ckzi/CVE-2009-2265
View Code
GitHub https://github.com/h3x0v3rl0rd/CVE-2009-2265
View Code
GitHub https://github.com/0xDTC/Adobe-ColdFusion-8-RCE-CVE-2009-2265
View Code
GitHub https://github.com/nika0x38/CVE-2009-2265
View Code
Exploit-DB https://www.exploit-db.com/exploits/50057
View Code
Exploit-DB https://www.exploit-db.com/exploits/16788
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected Stack

No specific products linked.