Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

phpGroupWare VFS files reachable through web site

CVE-2003-0599 · published 23 years ago
Summary

The virtual file system used by phpGroupWare versions up to 0.9.14.004 and the pre‑release 0.9.16 puts its storage directory inside the web server’s publicly accessible folders. This can allow anyone who knows the location to view or download internal files. Move the VFS directory outside the web document root or add server rules that block direct web access to it.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
phpgroupware phpgroupware <= 0.9.14.004
0.9.16prerc
cpe:2.3:a:phpgroupware:phpgroupware:*:*:*:*:*:*:*:*
Original advisory text
Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare 0.9.16preRC and versions before 0.9.14.004 with unknown implications, related to the VFS path being under the web ...
Unknown vulnerability in the Virtual File System (VFS) capability for phpGroupWare 0.9.16preRC and versions before 0.9.14.004 with unknown implications, related to the VFS path being under the web document root.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
2% chance of attack within 30 days
Timeline
Published27 Aug 2003
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2003-0599 · NVD
Track software like this
Free during beta