CVE-2010-3909
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows...
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.
Exploit likelihood
What each source reports
NVD Score used
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.
- Record
CVE-2010-3909- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.
- Record
CVE-2010-3909- Updated
- 2026-11-02
EUVDEUVD-2010-3887 No score
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.
- Record
EUVD-2010-3887- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8wgg-7fpq-c3vx No score
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows...
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.
- Record
GHSA-8wgg-7fpq-c3vx- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-3909 is a medium vulnerability (CVSS 6.0) in Vtiger Crm, published November 26, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 75th percentile. No source names a fixed version.
References
ush.it/team/ush/hack-vtigercrm_520/vtigercrm_520.txt
vtiger.com/blogs/2010/11/16/vtiger-crm-521-is-released
secunia.com/advisories/42246
wiki.vtiger.com/index.php/Vtiger521:Release_Notes
securityfocus.com/archive/1/514846/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2010-3909
github.com/advisories/GHSA-8wgg-7fpq-c3vx