Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (…

published 2005-11-16 20 y ago modified 2026-06-16 4 mo ago also EUVD-2005-3558

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 20.2%; EPSS 20.2% chance of exploitation in 30 days, percentile 97%
public exploits: 1; Exploit-DB

Directory traversal vulnerability in vmail.cgi in Asterisk 1.0.9 through 1.2.0-beta1 allows remote attackers to access WAV files via a .. (dot dot) in the folder parameter.

Patch / fix

distros 1

asterisk Debian 14 1:1.2.7.1.dfsg-2

debian advisories DEBIAN-CVE-2005-3559

Timeline

2005-11-07 First public exploit (EDB-26475)
2005-11-16 Published

Exploit prediction

20.16% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-26475 Asterisk 0.x/1.0/1.2 Voicemail - Unauthorized Access webapps, 2005-11-07
assurance.com.au http://www.assurance.com.au/advisories/200511-asterisk.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N

References

assurance.com.au /advisories/200511-asterisk.txt
exploit, vendor-advisory
debian.org /security/2006/dsa-1048
vendor-advisory
secunia.com /advisories/17459
third-party-advisory, vendor-advisory
securityfocus.com /bid/15336
vdb-entry
secunia.com /advisories/19872
third-party-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/23002
vdb-entry
securityfocus.com /archive/1/415990/30/0/threaded
mailing-list
vupen.com /english/advisories/2005/2346
vdb-entry
securitytracker.com /id?1015164
vdb-entry
osvdb.org /20577
vdb-entry

Sources

CVE List CVE-2005-3559
NVD CVE-2005-3559

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary