CVE-2009-3561

Xerver HTTP Server 4.32 - Path Traversal via chooseDirectory currentPath Parameter

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-3561. PoCs published by Stack.

AI-analyzed exploit summary The exploit demonstrates a directory traversal and XSS vulnerability in Xerver HTTP Server v4.32. The directory traversal allows accessing arbitrary files by manipulating the 'currentPath' parameter, while the XSS is triggered via script injection in the same parameter.

Description

Directory traversal vulnerability in Xerver HTTP Server 4.32 allows remote attackers to read arbitrary files via a full pathname with a drive letter in the currentPath parameter in a chooseDirectory action.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Stack · textremotemultiple
https://www.exploit-db.com/exploits/9718

The exploit demonstrates a directory traversal and XSS vulnerability in Xerver HTTP Server v4.32. The directory traversal allows accessing arbitrary files by manipulating the 'currentPath' parameter, while the XSS is triggered via script injection in the same parameter.

Classification
Working Poc 90%
Attack Type
Xss | Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Xerver HTTP Server v4.32
No auth needed
Prerequisites: Network access to the target server · Xerver HTTP Server v4.32 running
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/9718

Scores

EPSS 0.0280
EPSS Percentile 84.5%

Details

CWE
CWE-22
Status published
Products (1)
xerver/xerver 4.32
Published Oct 05, 2009
Tracked Since Feb 18, 2026