CVE-2009-4946

CVE-2009-4946 describes a directory traversal vulnerability in the Messaging component (com_messaging) of Joomla! versions prior to 1.5.1. This flaw allows unauthenticated remote attackers to include and execute arbitrary local files by manipulating the 'controller' parameter in a 'messages' action to index.php. The vulnerability has a CVSS score of 6.8 (Medium), indicating it can be exploited over the network with medium attack complexity, requiring no authentication, and potentially leading to partial compromise of confidentiality, integrity, and availability. While the EPSS score is very low, suggesting a low probability of exploitation, its FAUCET Risk Score is 40/100. There is no known public exploit code available for this vulnerability, nor is it listed in CISA's KEV catalog. Community discussion and media coverage are minimal, suggesting it has not garnered significant attention or active exploitation.