CVE-2009-3304: Gforge

Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days.

GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users' home directories, related to deb-specific/ssh_dump_update.pl and cronjobs/cvs-cron/ssh_create.php.

Affected products

• Gforge Gforge: version 4.5.14 only; version 4.7 only; version 4.8.2 only

Published 2009-12-04. Last modified 2026-06-16.