CVE-2007-2285

This bug is like a “file address” form that doesn’t properly stop people from walking outside the folder they’re supposed to access. If someone finds the right request, they can trick the server into returning other files, not just the expected feed content. For a business, that can mean outsiders reading configuration files, stored data, or other sensitive information.

This matters if your small business website or app is still using Jack Slocum Ext 1.0 alpha1 (Ext JS) and that feed-proxy.php functionality is present. The findings indicate the attacker does not need a login to try to read files. Final reachability depends on whether the vulnerable feed-proxy.php endpoint is reachable over the network in your deployment (reachable from the internet and not blocked/disabled).

Treat this as an urgent patching/removal item because attackers can read arbitrary files remotely without authentication, and public exploit code exists. Even though this specific issue is old and not confirmed as listed in CISA KEV, the combination of unauthenticated file access and an available public exploit makes it high-risk for exposed deployments.