Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

GForge 3.3 lets attackers view any folder

CVE-2005-0299 · published 21 years ago
Summary

Versions of GForge up to 3.3 let a remote user include ".." in a web request and see files or directory listings outside the intended area. This could expose source code, configuration files, or other private data. Upgrade to a newer GForge release or apply the vendor's patch and limit web access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gforge gforge 3.1
3.2
3.3
3.21
cpe:2.3:a:gforge:gforge:3.1:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in GForge 3.3 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the (1) dir parameter to controller.php or (2) dir_name param...
Directory traversal vulnerability in GForge 3.3 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the (1) dir parameter to controller.php or (2) dir_name parameter to controlleroo.php.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published2 May 2005
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-0299 · NVD
Track software like this
Free during beta