CVE-2005-4086 json
Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and…
published 2005-12-08 20 y ago modified 2026-06-16 4 mo ago also EUVD-2005-4081
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.3%
- EPSS 7.3% chance of exploitation in 30 days, percentile 94%
- public exploits
- 2
- Exploit-DB
Summary
Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the beanFiles array parameter.
Timeline
- First public exploit (EDB-1359)
- Published
Exploit prediction
7.33% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-1364 SugarSuite Open Source 4.0beta - Remote Code Execution (2) webapps, 2005-12-08
- EDB-1359 SugarSuite Open Source 4.0beta - Remote Code Execution (1) webapps, 2005-12-07
- securityfocus.com http://www.securityfocus.com/archive/1/418840 referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/15760 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
References
-
securityfocus.com
/archive/1/418840
mailing-list, exploit
-
securityfocus.com
/bid/15760
vdb-entry, exploit
-
securitytracker.com
/id?1015322
vdb-entry
-
vupen.com
/english/advisories/2005/2800
vdb-entry
- rgod.altervista.org /sugar_suite_40beta.html
-
secunia.com
/advisories/17948
third-party-advisory
Sources
- CVE List CVE-2005-4086
- NVD CVE-2005-4086
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.