Vulnerability record · CVE-2009-2265 · published 5 July 2009
CVE-2009-2265: FCKeditor connector directory traversal enables arbitrary file creation
Fckeditor · Fckeditor
FCKeditor before 2.6.4.1 contains multiple directory traversal flaws in its connector modules, reachable through the file browser and editor/filemanager/connectors/ directory. Attackers can use traversal sequences to write executable files into arbitrary directories, which was exploited in the wild in July 2009 for remote code execution.
Description
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
critical priorityUnauthenticated network exploitation leads to remote code execution, was exploited in the wild, and has very high EPSS despite not being in KEV.
What it is
FCKeditor before 2.6.4.1 contains multiple directory traversal flaws in its connector modules, reachable through the file browser and editor/filemanager/connectors/ directory. Attackers can use traversal sequences to write executable files into arbitrary directories, which was exploited in the wild in July 2009 for remote code execution.
Impact
An attacker can place executable files anywhere the web server can write, leading to remote code execution under the web server's privileges. This gives full control over the affected application and potentially the host.
Attack surface
The flaw is network-reachable through the FCKeditor connector endpoints (file browser and editor/filemanager/connectors/). The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
The description states it was exploited in the wild for remote code execution in July 2009. It is not listed in CISA KEV, but EPSS is very high at 0.83744 (99.675th percentile), and a reference is tagged Patch.
What to do
- Upgrade FCKeditor to 2.6.4.1 or later, or apply the vendor patch referenced in the OCert advisory.
- If FCKeditor cannot be updated, disable or remove the file browser and connector modules, or restrict access to editor/filemanager/connectors/.
- Configure the web server to deny execution of scripts in upload and file storage directories.
- Run the web server with least privilege and ensure its account cannot write to web-executable directories.
- Audit for and remove any unexpected executable files written by the connector.
Detection
- Monitor web logs for traversal sequences such as ../ in requests to FCKeditor connector paths.
- Alert on file creation events in web-accessible directories, especially new executable files.
- Review connector endpoint access for unexpected upload or file creation requests.
- Check for known FCKeditor connector paths being accessed from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2009-2265 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2009-2265), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
