Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

PHP lets local users drop files in other folders

CVE-2006-2660 · published 20 years ago
Summary

On certain older PHP versions, a coding mistake lets someone with local access create PHP files in directories they shouldn't reach. This could let them run their own code on your server. Upgrade PHP to a newer version or apply the recommended patches to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
php php 4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.1.0
4.1.1
4.1.2
4.2.0
4.2.1
4.2.2
18 more version ranges
cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*
Original advisory text
Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a...
Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Timeline
Published13 Jun 2006
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2006-2660 · NVD
Track software like this
Free during beta