{"id":"CVE-2008-6177","title":"Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and exec","published":"2009-02-19T12:30:00.517Z","updated":"2026-06-16T19:01:45.583Z","severity":"medium","cvssScore":6.8,"epss":0.01857,"epssPct":0.79507,"kev":false,"maturity":"poc","actionScore":28,"primaryVendor":"publicwarehouse","primaryProduct":"lightblog","cweId":"CWE-22","fixAvailable":false,"tags":["pre-auth","rce","path-traversal","remote"],"epssDelta7":0,"summary":"Multiple directory traversal vulnerabilities in LightBlog 9.8, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) username parameter to view_member.php, (2) username_post parameter to login.php, and the (3) Lightblog_username cookie parameter to check_user.php.","cvssVector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","cvssVersion":"2.0","cvssSource":"nvd-primary","cweName":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-07T11:20:25.545Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:45:07.184Z","exploitdb":"2026-11-13T03:17:58.683Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":1,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"publicwarehouse","product":"lightblog","cpe":"cpe:2.3:a:publicwarehouse:lightblog"}],"references":[{"url":"http://secunia.com/advisories/32345","tags":"Vendor Advisory"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/46030","tags":null}],"exploits":[{"source":"exploitdb","kind":"webapps","date":"2008-10-21"}],"analysis":null,"affectedVersions":[{"vendor":"publicwarehouse","product":"lightblog","version":"9.8","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}