CVE-2009-3902: Cherokee Httpd

Medium severity, CVSS 5.0. EPSS: 3.5% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Cherokee Web Server 0.5.4 and earlier for Windows allows remote attackers to read arbitrary files via a /\.. (slash backslash dot dot) in the URL.

Affected products

• Cherokee Cherokee Httpd: version 0.5.4 only

Published 2009-11-06. Last modified 2026-06-16.