TI-2009-04921 Aliases CVE-2009-20011 GHSA-w8w9-prcc-w4vw

ContentKeeper Web Appliance < 125.10 RCE via mimencode

HIGH 82CWE-434Published 2025-08-30 · Updated 2026-05-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, resulting in root-level access if successful.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01944 80th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA

Fix Fixed ContentKeeper Web Appliance (ContentKeeper Technologies): 125.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ContentKeeper Technologies	ContentKeeper Web Appliance	before 125.10	125.10	Patch available	CNA

ContentKeeper Web Appliance VendorContentKeeper Technologies Affected before 125.10 Fixed in 125.10 Patch available CNA

Remediation

Fix · CNA ContentKeeper Web Appliance (ContentKeeper Technologies) Fixed in 125.10

Timeline

2026-10-02 Threatist record created from CVE-2009-20011
2026-10-03 Alias added: GHSA-w8w9-prcc-w4vw

References

Exploit 2

Patch 1

https://www.ativion.com/contentkeeper/

Other 1

https://web.archive.org/web/20081220084819/http://www.contentkeeper.com/

TI-2009-04908 ContentKeeper Web Appliance < 125.10 Arbitrary File Access via mimencode CVSS 4.0HIGH 8.7
TI-2006-04834 ContentKeeper 123.25 and earlier places passwords in cleartext in an INPUT element in… CVSS 2.0MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences