TI-2010-05064 Aliases CVE-2010-20109 GHSA-f6fv-779g-j5qr

Barracuda Spam & Virus Firewall "locale" Path Traversal

HIGH 77CWE-22Published 2025-08-21 · Updated 2026-05-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Barracuda products, confirmed in Spam & Virus Firewall, SSL VPN, and Web Application Firewall versions prior to October 2010, contain a path traversal vulnerability in the view_help.cgi endpoint. The locale parameter fails to properly sanitize user input, allowing attackers to inject traversal sequences and null-byte terminators to access arbitrary files on the underlying system. By exploiting this flaw, unauthenticated remote attackers can retrieve sensitive configuration files such as /mail/snapshot/config.snapshot, potentially exposing credentials, internal settings, and other critical data.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01683 77th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Barracuda Networks	Spam & Virus Firewall	up to 4.1.1.021	—	No fix listed	CNA
Barracuda Networks	SSL VPN	up to 2010-10	—	No fix listed	CNA
Barracuda Networks	Web Application Firewall	up to 2010-10	—	No fix listed	CNA

Spam & Virus Firewall VendorBarracuda Networks Affected up to 4.1.1.021 Fixed in — No fix listed CNA
SSL VPN VendorBarracuda Networks Affected up to 2010-10 Fixed in — No fix listed CNA
Web Application Firewall VendorBarracuda Networks Affected up to 2010-10 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2010-20109
2026-10-03 Alias added: GHSA-f6fv-779g-j5qr

References

Exploit 2

Advisory 1

https://web.archive.org/web/20101004131244/http://secunia.com/advisories/41609/

TI-2023-02687 Remote Code injection in Barracuda Email Security Gateway KEVCVSS 3.1CRITICAL 9.8
TI-2025-24469 Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE CVSS 4.0CRITICAL 10.0
TI-2023-06497 Remote code execution (RCE) in Barracuda ESG Appliance CVSS 3.1CRITICAL 9.8
TI-2005-02695 img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote… CVSS 2.0HIGH 7.5
TI-2025-24471 Barracuda RMM < 2025.1.1 Service Center .NET Remoting Deserialization RCE CVSS 4.0CRITICAL 10.0
TI-2025-24470 Barracuda RMM < 2025.1.1 Service Center Insecure Reflection RCE CVSS 4.0CRITICAL 10.0

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences