CVE-2009-1526: Directadmin

Medium severity, CVSS 6.9. EPSS: 0.6% chance of exploitation in the next 30 days.

JBMC Software DirectAdmin before 1.334 allows local users to create or overwrite any file via a symlink attack on an arbitrary file in a certain temporary directory, related to a request for this temporary file in the PATH_INFO to the CMD_DB script during a backup action.

Affected products

• Directadmin Directadmin: before 1.33.4 (fixed in 1.33.4)

Published 2009-05-05. Last modified 2026-06-16.