blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2006-7204

LOW 2.1 CVSS 2.0
Published
May 22, 2007
Last modified
June 16, 2026
NVD status
Modified
Reported by
cve@mitre.org
CVSS vector
AV:L/AC:L/Au:N/C:P/I:N/A:N

Description

The imap_body function in PHP before 4.4.4 does not implement safemode or open_basedir checks, which allows local users to read arbitrary files or list arbitrary directory contents.

Affected products and versions

  • PHP — From 4.4.0 (including) to 4.4.4 (excluding)
  • PHP — From 5.1.0 (including) to 5.1.5 (excluding)

References

  • bugs.php.net http://bugs.php.net/bug.php?id=37265 Vendor Advisory
  • secunia.com http://secunia.com/advisories/21546 Patch, Vendor Advisory
  • us2.php.net http://us2.php.net/ChangeLog-4.php#4.4.4 Vendor Advisory
  • www.osvdb.org http://www.osvdb.org/28005 Broken Link, Patch
  • nvd.nist.gov Official NVD record