CVE-2010-4634

Medium

Published: 30/12/2010(UTC)Updated: 10/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.48%

83th percentile - higher than 83% of all known CVEs

Summary

A directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a '..' sequence in the file parameter to module.php, a different vector than CVE-2005-1439. This issue has been disputed by a reliable third party.

Risk Assessment

An attacker can read sensitive system files such as configurations or credentials, leading to information disclosure and potential attack escalation.

Recommendation

Immediately update osTicket to the latest stable version and implement file path validation in module.php to block '..' sequences.

Original NVD description (English source)

Directory traversal vulnerability in osTicket 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to module.php, a different vector than CVE-2005-1439. NOTE: this issue has been disputed by a reliable third party