Description
Absolute path traversal vulnerability in MLDonkey 2.8.4 through 2.9.7 allows remote attackers to read arbitrary files via a leading "//" (double slash) in the filename.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | mldonkey | 2.9.5-2+lenny1 | DSA-1739-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- MLdonkey 2.9.7 - Arbitrary File Disclosure EDB-8097 · remote · Feb 23, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-1739-1 mldonkey - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026
References
- 8097 exploit
- FEDORA-2009-2703 vendor-advisory
- 34008 third-party-advisory
- FEDORA-2009-2758 vendor-advisory
- 34436 third-party-advisory
- [oss-security] 20090223 CVE request: mldonkey arbitrary file download vulnerability mailing-list
- http://savannah.nongnu.org/bugs/?25667
- GLSA-200903-36 vendor-advisory
- 33865 vdb-entry
- 34345 third-party-advisory
- DSA-1739 vendor-advisory
- 34306 third-party-advisory