TI-2006-03736 Aliases CVE-2006-3850 GHSA-2j3g-cq99-w5x4

PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier…

LOW 29Published 2006-07-25 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter. NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0. CVE analysis concurs with the dispute, but it is unclear whether older versions are affected

Why it matters now

EPSS 0.03449 89th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lussumo:vanilla::::::::	up to 1.0.1	Vulnerable	Lussumo

cpe:2.3:a:lussumo:vanilla:*:*:*:*:*:*:*:* Versions up to 1.0.1 Vulnerable ·Lussumo

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2006-3850
2026-10-03 Alias added: GHSA-2j3g-cq99-w5x4

References

Advisory 1

1281

Other 3

TI-2010-01292 Multiple PHP remote file inclusion vulnerabilities in definitions.php in Lussumo Vanilla… CVSS 2.0HIGH 7.5
TI-2007-05425 Lussumo Vanilla 1.1.3 and earlier does not require admin privileges for (1)… CVSS 2.0HIGH 7.5
TI-2007-05424 Multiple SQL injection vulnerabilities in Lussumo Vanilla 1.1.3 and earlier allow remote… CVSS 2.0HIGH 7.5
TI-2008-03601 Cross-site request forgery (CSRF) vulnerability in ajax/UpdateCheck.php in Vanilla 1.1.4… CVSS 2.0HIGH 7.5
TI-2008-03600 Multiple cross-site scripting (XSS) vulnerabilities in Lussumo Vanilla 1.1.4 and earlier… CVSS 2.0MEDIUM 4.3
TI-2009-01757 Cross-site scripting (XSS) vulnerability in ajax/updatecheck.php in Lussumo Vanilla 1.1.5… CVSS 2.0MEDIUM 4.3

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences