CVE-2009-2265
Estado: ModificadaAlta (7.5)—
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 84%
- Percentil entre todas las CVEs puntuadas: 100
- Fecha de la puntuación: 2/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-22
Referencias
- http://isc.sans.org/diary.html?storyid=6724
- http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html
- http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html
- http://secunia.com/advisories/35833
- http://secunia.com/advisories/35909
- http://sourceforge.net/project/shownotes.php?release_id=695430
- http://www.debian.org/security/2009/dsa-1836
- http://www.ocert.org/advisories/ocert-2009-007.html
- http://www.securityfocus.com/archive/1/504721/100/0/threaded
- http://www.securitytracker.com/id?1022513
- http://www.vupen.com/english/advisories/2009/1813
- http://www.vupen.com/english/advisories/2009/1825
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html
- http://isc.sans.org/diary.html?storyid=6724
- http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html
- http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html
- http://secunia.com/advisories/35833
- http://secunia.com/advisories/35909
- http://sourceforge.net/project/shownotes.php?release_id=695430
- http://www.debian.org/security/2009/dsa-1836
- http://www.ocert.org/advisories/ocert-2009-007.html
- http://www.securityfocus.com/archive/1/504721/100/0/threaded
- http://www.securitytracker.com/id?1022513
- http://www.vupen.com/english/advisories/2009/1813
- http://www.vupen.com/english/advisories/2009/1825
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html
- https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2009-2265",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-07-05T16:30:00.377",
"references": [
{
"url": "http://isc.sans.org/diary.html?storyid=6724",
"source": "cve@mitre.org"
},
{
"url": "http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html",
"source": "cve@mitre.org"
},
{
"url": "http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/35833",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/35909",
"source": "cve@mitre.org"
},
{
"url": "http://sourceforge.net/project/shownotes.php?release_id=695430",
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2009/dsa-1836",
"source": "cve@mitre.org"
},
{
"url": "http://www.ocert.org/advisories/ocert-2009-007.html",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/504721/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id?1022513",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1813",
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1825",
"source": "cve@mitre.org"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html",
"source": "cve@mitre.org"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html",
"source": "cve@mitre.org"
},
{
"url": "http://isc.sans.org/diary.html?storyid=6724",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/35833",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/35909",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://sourceforge.net/project/shownotes.php?release_id=695430",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2009/dsa-1836",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.ocert.org/advisories/ocert-2009-007.html",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/504721/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1022513",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1813",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/1825",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00710.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00750.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory."
},
{
"lang": "es",
"value": "Múltiples vulnerabilidades de salto de directorio en FCKeditor anterior a v2.6.4.1, permiten a atacantes remotos crear ficheros ejecutables en directorios de su elección a través de secuencias de salto de directorio en la entrada de módulos conectores no especificados, tal como se ha explotado en Julio 2009. Está relacionado con el fichero de navegación y el directorio editor/filemanager/connectors/."
}
],
"lastModified": "2026-06-16T23:09:05.930",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A935AD9-DB0B-47A9-8F5E-9FF2A3310865",
"versionEndIncluding": "2.6.4"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A396BB3-7329-4522-8C5F-99CCA41C9DA6"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0_fc:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97BEB138-2E35-4770-BA2B-D78FFC6E6CE2"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0_rc2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD08F2AA-D782-419D-945C-D241EB18CBB2"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0rc2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6F9F4D2-0A3E-49D6-9A58-D9BCDF492E90"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.0rc3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF47BD2F-7AC9-490E-9289-9C259FE4F231"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "490C6198-FDA6-45BF-B12F-6F9A52B6F1C8"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83806F80-BA69-4098-A4F6-1F9577871EBD"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2823302-CCF1-438B-B962-6EE49D371A28"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "43FBB64C-5D5D-43D0-A4B9-B08F0012B9D8"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28B4FB08-9605-4D05-98B6-844F701BFA35"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "95BF5CD1-7D68-4FBE-8116-23B4D1415B03"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE69FFCF-D442-492F-A5F6-56A02E4E9299"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.3.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31A4C3CC-27E5-4962-85B2-404EAF434B11"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "665C47D7-40EC-4F52-8EA0-0886EE8A9345"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2271D898-7973-412C-8EA2-EBFD22ABF25E"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6834FFFF-F463-4F01-BB13-46705B9933A2"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "68C583B7-5A09-4849-A1E1-600C87854A24"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F45886E0-9D00-42B4-AF12-87EFED09765C"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.5:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "72159C7B-3F8E-440F-8248-3A5A991957B5"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.5.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "631C1D5A-191E-40D7-A6E4-25C184314527"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2D47CE1F-04A6-4961-B0B3-5A3EC403EE14"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A2C7527-3513-4B72-8C8D-295A3A8BAD2A"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E18F60E3-3723-40F3-A632-C3B8B6157682"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E99B8429-1EBC-483D-87B6-281E2C49E35A"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.3:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "05B5740F-05C0-4155-BC11-50DE6F8285DB"
},
{
"criteria": "cpe:2.3:a:fckeditor:fckeditor:2.6.4:beta:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B9D86941-B839-43CC-A97E-CA52339A9871"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}