CVE-2009-2146

CVE-2009-2146 describes an unrestricted file upload vulnerability in the Compose Email feature of Sugar Community Edition (SugarCRM) versions prior to 5.2f. An authenticated attacker can exploit this by uploading a file with only an extension (e.g., ".php") and then directly accessing it to execute arbitrary code. The vulnerability has a CVSS score of 6.0, indicating a medium severity, as it requires authentication and moderate attack complexity, but can lead to partial compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.