CVE-2006-6690 json
rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows…
published 2006-12-21 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-6673
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.3%
- EPSS 6.3% chance of exploitation in 30 days, percentile 93%
- public exploits
- 1
- Exploit-DB
Summary
rtehtmlarea/pi1/class.tx_rtehtmlarea_pi1.php in Typo3 4.0.0 through 4.0.3, 3.7 and 3.8 with the rtehtmlarea extension, and 4.1 beta allows remote authenticated users to execute arbitrary commands via shell metacharacters in the userUid parameter to rtehtmlarea/htmlarea/plugins/SpellChecker/spell-check-logic.php, and possibly another vector.
Patch / fix
- securitytracker.com/id?1017428 patch
- securityfocus.com/bid/21680 patch
- secunia.com/advisories/23466 advisory
- secunia.com/advisories/23446 advisory
Timeline
- First public exploit (EDB-29300)
- Published
Exploit prediction
6.33% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-29300 Typo3 3.7/3.8/4.0 - 'Class.TX_RTEHTMLArea_PI1.php' Multiple Remote Command Execution Vulnerabilities webapps, 2006-12-20
- securitytracker.com http://securitytracker.com/id?1017428 referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/21680 referenced PoC, tagged "exploit" by a source, unverified
- sec-consult.com http://www.sec-consult.com/272.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
secunia.com
/advisories/23466
third-party-advisory, patch, vendor-advisory
-
securitytracker.com
/id?1017428
vdb-entry, exploit, patch
-
secunia.com
/advisories/23446
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/21680
vdb-entry, exploit, patch
-
sec-consult.com
/272.html
exploit
-
lists.netfielders.de
/pipermail/typo3-announce/2006/000045.html
mailing-list, vendor-advisory
-
lists.netfielders.de
/pipermail/typo3-announce/2006/000046.html
mailing-list, vendor-advisory
-
securityfocus.com
/archive/1/454944/100/0/threaded
mailing-list
-
securityreason.com
/securityalert/2056
third-party-advisory
- typo3.org /news-single-view/?tx_newsimporter_pi1%5BshowItem%5D=0&cHash=e4a40a11a9
-
vupen.com
/english/advisories/2006/5094
vdb-entry
Sources
- CVE List CVE-2006-6690
- NVD CVE-2006-6690
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.