Servers and applications
CVE-2009-4449
Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php.
- Severity
- Medium 6.5
- Published
- 29 Dec 2009
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 2.7% in the next 30 daysHigher than 86% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- Path traversal (CWE-22)
- Attack
- Over the network · Needs a user account · No user action needed
- Attacker can
- Read data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MyBBServers and applications · cpe:a:mybb:mybb |
|