CVE-2009-3787: Vivvo

Medium severity, CVSS 5.0. EPSS: 6.6% chance of exploitation in the next 30 days.

files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct directory traversal attacks and read arbitrary files via the file parameter with "logs/" in between two . (dot) characters, which is filtered into a "../" sequence.

Affected products

• Vivvo Vivvo: version 4.1.5.1 only

Published 2009-10-26. Last modified 2026-06-16.