CVE-2009-4449

Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php.

• CWE-22

• http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/Release Notes
• http://dev.mybboard.net/issues/617Broken Link
• http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.phpBroken Link, Exploit
• http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.phpBroken Link, Exploit
• http://openwall.com/lists/oss-security/2010/10/08/7Mailing List
• http://openwall.com/lists/oss-security/2010/10/11/8Mailing List
• http://openwall.com/lists/oss-security/2010/12/06/2Mailing List
• http://osvdb.org/61359Broken Link
• http://secunia.com/advisories/37906Broken Link, Vendor Advisory
• http://www.securityfocus.com/bid/37489Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/3651Permissions Required, Vendor Advisory
• http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update/Release Notes
• http://dev.mybboard.net/issues/617Broken Link
• http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/admin/modules/user/users.phpBroken Link, Exploit
• http://dev.mybboard.net/projects/mybb/repository/revisions/4663/diff/branches/1.4-stable/usercp.phpBroken Link, Exploit
• http://openwall.com/lists/oss-security/2010/10/08/7Mailing List
• http://openwall.com/lists/oss-security/2010/10/11/8Mailing List
• http://openwall.com/lists/oss-security/2010/12/06/2Mailing List
• http://osvdb.org/61359Broken Link
• http://secunia.com/advisories/37906Broken Link, Vendor Advisory
• http://www.securityfocus.com/bid/37489Broken Link, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/3651Permissions Required, Vendor Advisory

Published

Dec 29, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4443Unspecified vulnerability in the psearch (aka persistent sea…
• CVE-2009-4444Microsoft Internet Information Services (IIS) 5.x and 6.x us…
• CVE-2009-4445Microsoft Internet Information Services (IIS), when used in …
• CVE-2009-4446Cross-site scripting (XSS) vulnerability in admin.php in php…
• CVE-2009-4447Jax Guestbook 3.5.0 allows remote attackers to bypass authen…
• CVE-2009-4448inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10,…
• CVE-2009-4450Multiple cross-site scripting (XSS) vulnerabilities in map.p…
• CVE-2009-4451Unrestricted file upload vulnerability in upper.php in kanda…
• CVE-2009-4452Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x…
• CVE-2009-4453Insecure method vulnerability in SoftCab Sound Converter Act…
• CVE-2009-4454vccleaner in VideoCache 1.9.2 allows local users with Squid …
• CVE-2009-4455The default configuration of Cisco ASA 5500 Series Adaptive …