CVE-2009-2109

CVE-2009-2109 describes multiple directory traversal vulnerabilities in FretsWeb 1.2, allowing remote attackers to read arbitrary files. Specifically, an attacker can manipulate the 'language' parameter in charts.php or the 'fretsweb_language' cookie to traverse directories. With a CVSS score of 5.0, this vulnerability is of medium severity, requiring no authentication and having a low attack complexity, potentially leading to information disclosure. While not listed in CISA's KEV catalog, public exploit code exists on ExploitDB, though there is no evidence of active exploitation or significant community discussion.