CVE-2008-4486: Yerba

High severity, CVSS 10.0. EPSS: 4.8% chance of exploitation in the next 30 days.

Directory traversal vulnerability in index.php in SAC.php (SACphp), as used in Yerba 6.3 and earlier, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.

Affected products

• Yerba Yerba: up to and including 6.3; version 6.28 only

Published 2008-10-08. Last modified 2026-06-16.