CVE-2008-1856: Linpha

Medium severity, CVSS 5.1. EPSS: 2.7% chance of exploitation in the next 30 days.

plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication for a settings action that modifies the configuration file, which allows remote attackers to conduct directory traversal attacks and execute arbitrary local files by placing directory traversal sequences into the maps_type configuration setting, and then sending a request to maps_view.php, which causes plugins/maps/map.main.class.php to use the modified configuration.

Affected products

• Linpha Linpha: any version; version 0.9.0 only; version 0.9.1 only; version 0.9.2 only; version 0.9.3 only; version 0.9.4 only; …

Published 2008-04-16. Last modified 2026-06-16.