Description
Multiple directory traversal vulnerabilities in the mlmmj-php-admin web interface for Mailing List Managing Made Joyful (mlmmj) 1.2.15 through 1.2.17 allow remote authenticated users to overwrite, create, or delete arbitrary files, or determine the existence of arbitrary directories, via a .. (dot dot) in a list name in a (1) edit or (2) save action.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mlmmj | 1.2.17-1.1 | — |
| Debian 13 | mlmmj | 1.2.17-1.1 | — |
| Debian 12 | mlmmj | 1.2.17-1.1 | — |
| Debian 5.0 | mlmmj | 1.2.15-1.1+lenny1 | DSA-2073-1 |
Advisories 1
- DSA-2073-1 mlmmj - directory traversal Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://mlmmj.org/node/84
- [oss-security] 20100626 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface mailing-list
- http://bugs.gentoo.org/show_bug.cgi?id=259968
- [oss-security] 20100625 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface mailing-list
- 40658 third-party-advisory
- [oss-security] 20100623 CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=607256
- [oss-security] 20100706 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface mailing-list
- [oss-security] 20100623 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface mailing-list
- [oss-security] 20100704 Re: CVE Request -- mlmmj -- Directory traversal flaw by editing and saving list entries via php-admin web interface mailing-list
- DSA-2073 vendor-advisory