CVE-2006-5031: Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary…

PriorityP433medium5CVSS 2.0

AVNACLAuNCPINAN

EXPLOIT

EPSS

7.34%

93.6th percentile

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
cakephp	cakephp	<= 1.1.7.3363	—
cakephp	cakephp	>= 0 < 1.1.13.4450-1	1.1.13.4450-1
cakephp	cakephp	>= 1.0.1.2708 < 1.1.8.3544	1.1.8.3544
debian	cakephp	< cakephp 1.1.13.4450-1 (bullseye)	cakephp 1.1.13.4450-1 (bullseye)

CVSS provenance

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

osv5.0MEDIUM

vendor_debian5.0MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.