CVE-2009-2184: Gravy-Media Media Photo Host

Medium severity, CVSS 5.0. EPSS: 2.7% chance of exploitation in the next 30 days.

Absolute path traversal vulnerability in forcedownload.php in Gravy Media Photo Host 1.0.8 allows remote attackers to read arbitrary files via an encoded "/" (slash) in the file parameter.

Affected products

• Gravy-Media Media Photo Host: version 1.0.8 only

Published 2009-06-23. Last modified 2026-06-16.