CVE-2009-4415: Phpgroupware

High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days.

Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attackers to (1) read arbitrary files via the csvfile parameter to addressbook/csv_import.php, or (2) include and execute arbitrary local files via the conv_type parameter in addressbook/inc/class.uiXport.inc.php.

Affected products

Published 2009-12-24. Last modified 2026-06-16.