CVE-2008-6522 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 1.9% (pctl 79)
Patch early
A public exploit exists.
Description
Multiple directory traversal vulnerabilities in the RenderFile function in ContentRender.class.php in Terracotta (aka OpenTerracotta) 0.6.1, and possibly other versions, allow remote attackers to list arbitrary directories and read arbitrary files via a .. (dot dot) in the (1) CurrentDirectory and (2) File parameters to index.php.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 1.9% — more likely to be exploited than 79% of all CVEs |
| Weakness | CWE-22 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-03-25 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| devraj mukherjee | openterracotta |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Terracotta - 'index.php' Local File Inclusion | 2008-04-01 |
References
- http://www.securityfocus.com/archive/1/490341/100/0/threaded
- http://www.securityfocus.com/bid/28550
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41572
- http://www.securityfocus.com/archive/1/490341/100/0/threaded
- http://www.securityfocus.com/bid/28550
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41572
→ the Explorer · watch your stack · NVD