CVE-2006-5050: Directory traversal vulnerability in httpd in Rob Landley BusyBox allows remote attackers to read arbitrary fi

This month

MEDIUM 5.0DOWNGRADE

CVE-2006-5050 is a medium-severity flaw (CVSS 5.0) affecting busybox. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Directory traversal vulnerability in httpd in Rob Landley BusyBox allows remote attackers to read arbitrary files via URL-encoded "%2e%2e/" sequences in the URI.

Why this priority

Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	5.0 (Medium)
EPSS exploit chance	1.8% (top 22%)
CISA exploited list	No
Published	2006-09-27
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: rob landley

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2006-09-27 23:07 UTCPublished CVE record published
2026-06-16 22:30 UTCUpdated Record last modified

rob landley busybox DOWNGRADE

Affected: 1.01

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.01

1. Check installed version

apt-cache policy busybox || rpm -q busybox || busybox --version

2. No fixed release: DOWNGRADE to a release before 1.01 (Debian / Ubuntu)

apt-cache madison busybox sudo apt install busybox=<VERSION_BEFORE_1.01> sudo apt-mark hold busybox

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list busybox sudo dnf downgrade busybox-<VERSION_BEFORE_1.01> sudo dnf versionlock add busybox

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-5050?

busybox: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2006-5050 being exploited?

CVE-2006-5050 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-5050 affect?

CVE-2006-5050 affects busybox. Severity is medium (CVSS 5.0). Directory traversal vulnerability in httpd in Rob Landley BusyBox allows remote attackers to read arbitrary files via URL-encoded "%2e%2e/" sequences in the URI.

How urgent is CVE-2006-5050?

Priority 42/100. Public exploit reference

Software pages

Apache HTTP Server vulnerabilities

Related CVEs

CVE-2026-38754 MEDIUM 5.1 DOWNGRADE A heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Deni
CVE-2026-38755 LOW 2.9 DOWNGRADE A heap overflow in the evalcommand() function (shell/ash.c) of Busybox v1.38.0 allows attackers to cause a Den
CVE-2026-38753 MEDIUM 4.9 DOWNGRADE A use-after-free in the awk_sub() function (editors/awk.c) of Busybox v1.38.0 allows attackers to cause a Deni
CVE-2026-38752 LOW 2.9 DOWNGRADE A stack overflow in the evaluate() function (editors/awk.c) of BusyBox commit 371fe9 allows attackers to cause
CVE-2022-48174 CRITICAL 9.8 MITIGATE UPGRADE There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35

References

← Back to latest CVEs