CVE-2006-1865 json
Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject co…
published 2006-04-21 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1865
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.5%
- EPSS 3.5% chance of exploitation in 30 days, percentile 89%
- public exploits
- 0
- none known
Summary
Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing.
Patch / fix
- beagle_project beagle 0.2.5
- beagle Debian 14, Debian 13, Debian 12 0.2.6-2
debian advisories DEBIAN-CVE-2006-1865
Exploit prediction
3.48% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-88 Improper Neutralization of Argument Delimiters in a Command
References
-
lists.seifried.org
/pipermail/security/2006-April/013163.html
vendor-advisory, broken-link
-
novell.com
/linux/security/advisories/2006_04_28.html
vendor-advisory, broken-link
-
secunia.com
/advisories/19778
third-party-advisory, broken-link, vendor-advisory
-
secunia.com
/advisories/19781
third-party-advisory, broken-link, vendor-advisory
-
secunia.com
/advisories/19897
third-party-advisory, broken-link, vendor-advisory
-
securityfocus.com
/bid/17611
vdb-entry, broken-link, third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/26104
vdb-entry, third-party-advisory
-
bugzilla.redhat.com
/bugzilla/show_bug.cgi?id=189282
issue-tracking
-
scary.beasts.org
/security/CESA-2006-002.html
third-party-advisory
-
osvdb.org
/24938
vdb-entry, broken-link
Sources
- CVE List CVE-2006-1865
- NVD CVE-2006-1865
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.