Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

HP Photo Imaging ActiveX can be tricked to write files

CVE-2007-3487 · published 19 years ago
Summary

The ActiveX component in HP Photo Digital Imaging (hpqxml.dll version 2.0.0.133) lets a remote user specify any file path when using the saveXMLAsFile function. This can let an attacker create or replace files on the affected computer, potentially leading to unauthorized data changes or malicious code placement. Apply the vendor's patch or update to a newer version, and limit the use of ActiveX controls to trusted environments.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hp photo_digital_imaging_activex_control 2.0.0.133
cpe:2.3:a:hp:photo_digital_imaging_activex_control:2.0.0.133:*:*:*:*:*:*:*
Original advisory text
Absolute path traversal in a certain ActiveX control in hpqxml.dll 2.0.0.133 in Hewlett-Packard (HP) Photo Digital Imaging allows remote attackers to create or overwrite arbitrary files via the arg...
Absolute path traversal in a certain ActiveX control in hpqxml.dll 2.0.0.133 in Hewlett-Packard (HP) Photo Digital Imaging allows remote attackers to create or overwrite arbitrary files via the argument to the saveXMLAsFile method.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.4 Medium
Exploitation
9% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published29 Jun 2007
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2007-3487 · NVD
Track software like this
Free during beta