Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

PHP before 5.1.5 permits unsafe URL redirects

CVE-2006-4483 · published 20 years ago
Summary

Versions of PHP earlier than 5.1.5 let a web script follow redirects even when directory restrictions or safe mode are turned on. This can let an attacker cause the server to access unexpected locations or perform actions it shouldn't. Upgrade PHP to version 5.1.5 or later, or disable the redirect option in the code.

What to do
  • Update php php to version 5.1.5 or later.
Affected software
VendorProductAffected versions
php php < 5.1.5
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Original advisory text
The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows att...
The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published31 Aug 2006
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-4483 · NVD
Track software like this
Free during beta