Unscored severity · published Mar 31, 2009
CVE-2009-0841
Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to…
–
CVSS
5.3%
EPSS
No
On KEV
Description
Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remote attackers to create arbitrary files via a .. (dot dot) in the id parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.3% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mapserver · Osgeo
4.2.0; 4.4.0; 4.4.0; 4.4.0; 4.4.0; 4.6.0; +33 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0841
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0841
Patch
http://lists.osgeo.org/pipermail/mapserver-users/2009-March/060600.html
secunia.com
http://secunia.com/advisories/34520
secunia.com
http://secunia.com/advisories/34603
Vendor Advisory
http://trac.osgeo.org/mapserver/ticket/2942
www.debian.org
http://www.debian.org/security/2009/dsa-1914
Exploit
http://www.positronsecurity.com/advisories/2009-000.html
More from Mapserver
9.8
CVE-2025-59431
MapServer is a system for developing web-based GIS applications
9.8
CVE-2017-5522
Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attackers to cause a denial of service (crash)…
7.5
CVE-2026-45104
MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`
7.5
CVE-2026-33721
MapServer has heap buffer overflow in SLD `Categorize` Threshold parsing
7.5
CVE-2010-1678
Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing