CVE-2009-10005

HIGH

ContentKeeper Web Appliance <125.10 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2009-10005. PoCs published by Metasploit, aushack, including Metasploit module auxiliary/admin/http/contentkeeper_fileaccess.

AI-analyzed exploit summary This Metasploit module exploits a combination of vulnerabilities in ContentKeeper Web Appliance to achieve remote command execution as the Apache user, with potential privilege escalation to root via an insecure PATH call in a setuid binary.

Description

ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output parameters, attackers can read sensitive files such as /etc/passwd outside the webroot.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubywebappshardware
https://www.exploit-db.com/exploits/16923

This Metasploit module exploits a combination of vulnerabilities in ContentKeeper Web Appliance to achieve remote command execution as the Apache user, with potential privilege escalation to root via an insecure PATH call in a setuid binary.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: ContentKeeper Web Appliance versions prior to 125.10
No auth needed
Prerequisites: Network access to the target's web interface · Target running a vulnerable version of ContentKeeper Web Appliance
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC
by aushack · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/contentkeeper_fileaccess.rb

This Metasploit module exploits a file access vulnerability in ContentKeeper Web Appliance by abusing the 'mimencode' binary to retrieve arbitrary files outside the webroot via directory traversal. It sends a crafted POST request to encode the target file and then retrieves it via a GET request.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: ContentKeeper Web Appliance (version not specified)
No auth needed
Prerequisites: Network access to the ContentKeeper Web Appliance · The 'mimencode' binary must be accessible at the specified URI
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v4 8.7
EPSS 0.5241
EPSS Percentile 98.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-552
Status published
Products (1)
ContentKeeper Technologies/Web Appliance < 125.10
Published Aug 20, 2025
Tracked Since Feb 18, 2026