CVE-2008-2898

CRITICAL 9.3CVE-2008-2898 · Published 27/06/2008 · updated 16/06/2026

In short

CVE-2008-2898 is a CRITICAL (CVSS 9.3) vulnerability affecting hedgehog-cms (hedgehog-cms).
Chance of exploitation in the next 30 days (EPSS): 6.7%, higher than 94.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
hedgehog-cms hedgehog-cms	`= 1.21`	No fix yet

Description

Directory traversal vulnerability in includes/header.php in Hedgehog-CMS 1.21 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the c_temp_path parameter. NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.

References

osvdb.org/46480
secunia.com/advisories/30778 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/43277
exploit-db.com/exploits/5904

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free