CVE-2006-6376 - Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use ".." sequences to (1) read arbitrary files via the filename parameter in a download action, (2) delete arbitrary files via the delete parameter, and (3) modify arbitrary files via the edit parameter, which can be leveraged to execute arbitrary code

Back Back to CVE browser

HIGH

Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use ".." sequences to (1) read arbitrary files via the filename parameter in a download action, (2) delete arbitrary files via the delete parameter, and (3) modify arbitrary files via the edit parameter, which can be leveraged to execute arbitrary code

Published Dec 7, 2006

7.5

HIGH

CVSS 2.0

EPSS 4.18%

Description

Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use ".." sequences to (1) read arbitrary files via the filename parameter in a download action, (2) delete arbitrary files via the delete parameter, and (3) modify arbitrary files via the edit parameter, which can be leveraged to execute arbitrary code.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

https://exchange.xforce.ibmcloud.com/vulnerabilities/30687
vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/2883
exploitx_refsource_EXPLOIT-DB

Link	Providers	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilities/30687		vdb-entryx_refsource_XF
https://www.exploit-db.com/exploits/2883		exploitx_refsource_EXPLOIT-DB

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Dec 7, 2006

Updated Aug 7, 2024

Reserved Dec 7, 2006

Link CVE-2006-6376

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2006-6376

Red Hat

Severity n/a

Public date n/a

Links CVE-2006-6376