What is CVE-2009-20011?

CVE-2009-20011 is a vulnerability in Contentkeeper Technologies Web Appliance, classified under OS Command Injection. Published 2025-08-30.

Is CVE-2009-20011 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Contentkeeper Technologies Web Appliance

CVE-2009-20011

ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, resulting in root-level access if successful.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.013 (66.8th percentile) — read the EPSS interpretation.

Affected products

Contentkeeper Technologies Web Appliance — versions 0

Weakness classification (CWE)

Public proof-of-concept exploits

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (product, patch)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2009-20011?: CVE-2009-20011 is a vulnerability in Contentkeeper Technologies Web Appliance, classified under OS Command Injection. Published 2025-08-30.
Is CVE-2009-20011 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.