CVE-2006-7117 json
Multiple directory traversal vulnerabilities in Kubix 0.7 and earlier allow remote attackers to (1) include and execute arbitrary local fil…
published 2007-03-06 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-7099
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.0%
- EPSS 2.0% chance of exploitation in 30 days, percentile 81%
- public exploits
- 1
- Exploit-DB
Summary
Multiple directory traversal vulnerabilities in Kubix 0.7 and earlier allow remote attackers to (1) include and execute arbitrary local files via ".." sequences in the theme cookie to index.php, which is not properly handled by includes/head.php; and (2) read arbitrary files via ".." sequences in the file parameter in an add_dl action to adm_index.php, as demonstrated by reading connect.php.
Timeline
- First public exploit (EDB-2863)
- Published
Exploit prediction
2.03% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-2863 kubix 0.7 - Multiple Vulnerabilities webapps, 2006-11-29
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
exploit-db.com
/exploits/2863
exploit
-
exchange.xforce.ibmcloud.com
/vulnerabilities/30570
vdb-entry
-
securityfocus.com
/bid/21352
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/30572
vdb-entry
Sources
- CVE List CVE-2006-7117
- NVD CVE-2006-7117
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.