#VU110487 Path traversal in PHP - CVE-2006-1494

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU110487

#VU110487 Path traversal in PHP - CVE-2006-1494

Published: October 30, 2018 / Updated: June 9, 2025


Vulnerability identifier: #VU110487
Vulnerability risk: Low
CVSSv4.0:
CVE-ID: CVE-2006-1494
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
PHP
Software vendor:
PHP Group

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions. A remote authenticated attacker can send a specially crafted HTTP request and remote attackers to create files in arbitrary directories via the tempnam function.


Remediation

Install update from vendor's website.

External links