CVE-2009-4261
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through...
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."
Exploit likelihood
What each source reports
NVD Score used
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."
- Record
CVE-2009-4261- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."
- Record
CVE-2009-4261- Updated
- 2026-11-02
EUVDEUVD-2009-4230 No score
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."
- Record
EUVD-2009-4230- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3gm-pcx4-7hmp No score
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through...
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."
- Record
GHSA-h3gm-pcx4-7hmp- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."
- Record
CVE-2009-4261- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-4261 No score
Multiple directory traversal vulnerabilities in the iallocator framework in Ganeti 1.2.4 through 1.2.8, 2.0.0 through 2.0.4, and 2.1.0 before 2.1.0~rc2 allow (1) remote attackers to execute arbitrary programs via a crafted external script name supplied through the HTTP remote API (RAPI) and allow (2) local users to execute arbitrary programs and gain privileges via a crafted external script name supplied through a gnt-* command, related to "path sanitization errors."
- Record
DEBIAN-CVE-2009-4261- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-4261 is a high vulnerability (CVSS 7.5) in Roman Marxer Ganeti, published December 19, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.28%, the 88th percentile. Fixed in ganeti 2.0.5-1.
References
secunia.com/advisories/37849
vupen.com/english/advisories/2009/3599
securityfocus.com/archive/1/508535/100/0/threaded
openwall.com/lists/oss-security/2009/12/17/5
git.ganeti.org?p=ganeti.git%3Ba=blobdiff%3Bf=NEWS%3Bh=34b46426eca82c351e0a478c71edb66b9bb4b228%3Bhp=7f916c59238503915e927377d887b93eef1f676c%3Bhb=e5823b7e2cd8a3c9037a10aa59823a45642ce29f%3Bhpb=f95c81bf21c177f7e6a2c53ea0613034326329bd
Show 11 moreShow less
ocert.org/advisories/ocert-2009-019.html
groups.google.com/group/ganeti/browse_thread/thread/cbce23d89103a8d2
nvd.nist.gov/vuln/detail/CVE-2009-4261
github.com/advisories/GHSA-h3gm-pcx4-7hmp
security-tracker.debian.org/tracker/CVE-2009-4261