CVE-2006-5731

no score yetEPSS 2.4%

lithium cms lithium cms: no CVSS score yet. EPSS 2.4% chance of exploitation in the next 30 days.

Directory traversal vulnerability in classes/index.php in Lithium CMS 4.04c and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the siteconf[curl] parameter, as demonstrated by a POST to news/comment.php containing PHP code, which is stored under db/comments/news/ and included by classes/index.php.

EPSS: 2.4% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
Published: 2006-11-06
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

lithium_cms:lithium_cms

References

http://secunia.com/advisories/22593
http://www.securityfocus.com/bid/20871
http://www.vupen.com/english/advisories/2006/4361
https://exchange.xforce.ibmcloud.com/vulnerabilities/29966
https://www.exploit-db.com/exploits/2702

Check your stack JSON