Yappa Ng · Yappa-Ng · CVE-2008-4626
**Name of the Vulnerable Software and Affected Versions**
yappa-ng versions 2.3.2 through 2.3.3-beta0
**Description**
A directory traversal issue exists in index.php, allowing remote attackers to include and execute arbitrary local files when magic quotes gpc is disabled. This is achieved by using a .. (dot dot) in the `album` parameter.
**Recommendations**
For yappa-ng versions 2.3.2 through 2.3.3-beta0, consider enabling magic quotes gpc to prevent the exploitation of this issue. As a temporary workaround, restrict access to the album parameter in the index.php file to minimize the risk of arbitrary file inclusion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.