ContentKeeper Web Appliance < 125.10 RCE via mimencode

published 2025-08-30 14 mo ago modified 2026-10-01 38 d ago also EUVD-2009-5121

cvss: 10.0; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 80%
public exploits: 1; Metasploit

ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute arbitrary scripts as the Apache user. Additionally, the exploit can optionally escalate privileges by abusing insecure PATH usage in the benetool binary, resulting in root-level access if successful.

Patch / fix

fixed in 1 links 1

ContentKeeper Technologies ContentKeeper Web Appliance 125.10

ativion.com/contentkeeper/ patch

Timeline

2009-02-25 First public exploit (Metasploit exploit/unix/http/contentkeeperweb_mimencode)
2025-08-30 Published

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: total
Assessed: 14 mo ago (2025-09-02)

Exploit prediction

1.94% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/unix/http/contentkeeperweb_mimencode ContentKeeper Web Remote Command Execution metasploit exploit, excellent rank, 2009-02-25
raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/contentkeeperweb_mimencode.rb referenced PoC, tagged "exploit" by a source, unverified
aushack.com http://www.aushack.com/200904-contentkeeper.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA	4.0	10.0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

ContentKeeper Technologies ContentKeeper Web Appliance

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

ativion.com /contentkeeper/
product, patch
raw.githubusercontent.com /rapid7/metasploit-framework/master/modules/exploits/unix/http/contentkeeperweb_mimencode.rb
exploit
aushack.com /200904-contentkeeper.txt
exploit
web.archive.org /web/20081220084819/http://www.contentkeeper.com/
product
vulncheck.com /advisories/contentkeeper-web-appliance-rce-via-mimencode
third-party-advisory

Sources

CVE List CVE-2009-20011
NVD CVE-2009-20011

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary