Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

PHProjekt lets attackers read any file on server

CVE-2002-1761 · published 23 years ago
Summary

The PHProjekt collaboration software (versions 2.0 to 3.1) can be tricked into revealing any file stored on the server by using special path characters. This means someone outside your organization could view private documents, configuration files, or other sensitive data. Update to a patched version or restrict access to the application until a fix is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
phprojekt phprojekt 2.0
2.0.1
2.1
2.1a
2.2
2.3
2.4
2.4a
3.0
3.1
3.1a
cpe:2.3:a:phprojekt:phprojekt:2.0:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in PHProjekt 2.0 through 3.1 allows remote attackers to read arbitrary files via .. (dot dot) sequences.
Directory traversal vulnerability in PHProjekt 2.0 through 3.1 allows remote attackers to read arbitrary files via .. (dot dot) sequences.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
1% chance of attack within 30 days
Timeline
Published31 Dec 2002
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2002-1761 · NVD
Track software like this
Free during beta