CVE-2009-0422: Tincan Phplist

High severity, CVSS 7.5. EPSS: 6.2% chance of exploitation in the next 30 days.

Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SERVER[ConfigFile] parameter to admin/index.php.

Affected products

• Tincan Phplist: up to and including 2.10.8; version 1.0 only; version 1.0.1 only; version 1.1.2b only; version 1.1.3b only; version 1.1.4b only; …

Published 2009-02-05. Last modified 2026-06-16.