Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) la…

published 2006-02-15 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0720

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.1%; EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits: 4; Exploit-DB

Directory traversal vulnerability in LinPHA 1.0 allows remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) lang parameter in docs/index.php and the language parameter in (2) install/install.php, (3) install/sec_stage_install.php, (4) install/third_stage_install.php, and (5) install/forth_stage_install.php. NOTE: direct static code injection is resultant from this issue, as demonstrated by inserting PHP code into the username, which is inserted into linpha.log, which is accessible from the directory traversal.

Timeline

2006-02-11 First public exploit (EDB-27195)
2006-02-15 Published

Exploit prediction

3.09% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-27195 LinPHA 0.9.x/1.0 - 'forth_stage_install.php' Local File Inclusion webapps, 2006-02-11
EDB-27194 LinPHA 0.9.x/1.0 - 'sec_stage_install.php' Local File Inclusion webapps, 2006-02-11
EDB-27193 LinPHA 0.9.x/1.0 - 'install.php' Local File Inclusion webapps, 2006-02-11
EDB-27192 LinPHA 0.9.x/1.0 - 'lang' Local File Inclusion webapps, 2006-02-11
securityfocus.com http://www.securityfocus.com/bid/16592 referenced PoC, tagged "exploit" by a source, unverified
retrogod.altervista.org http://retrogod.altervista.org/linpha_10_local.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:P/A:N

References

securityfocus.com /bid/16592
vdb-entry, exploit
retrogod.altervista.org /linpha_10_local.html
exploit
secunia.com /advisories/18808
third-party-advisory, vendor-advisory
securityfocus.com /archive/1/424729/100/0/threaded
mailing-list
exchange.xforce.ibmcloud.com /vulnerabilities/24663
vdb-entry
securityreason.com /securityalert/426
third-party-advisory
vupen.com /english/advisories/2006/0535
vdb-entry

Sources

CVE List CVE-2006-0713
NVD CVE-2006-0713

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary