PatchTheCVECVE-2006-6613: Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc
CVE-2006-6613 is a medium-severity flaw (CVSS 6.8) affecting phpalbum. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files or obtain sensitive information via a .. (dot dot) in the pa_lang[include_file] parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by language.php.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.8 (Medium) |
| EPSS exploit chance | 2.2% (top 18%) |
| CISA exploited list | No |
| Published | 2006-12-18 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2006-6613?
phpalbum: upgrade to newer than 0.4.1_beta_6. Exact commands for each OS are on this page.
Is CVE-2006-6613 being exploited?
CVE-2006-6613 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2006-6613 affect?
CVE-2006-6613 affects phpalbum. Severity is medium (CVSS 6.8). Directory traversal vulnerability in language.php in phpAlbum 0.4.1 Beta 6 and earlier, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files or obtain sensit
How urgent is CVE-2006-6613?
Priority 49/100. Public exploit reference
Software pages
Apache HTTP Server vulnerabilities · PHP vulnerabilities
Related CVEs
- CVE-2011-4807 MEDIUM 5.0 UPGRADE Directory traversal vulnerability in main.php in phpAlbum 0.4.1.16 and earlier allows remote attackers to read
- CVE-2011-4806 MEDIUM 4.3 UPGRADE Multiple cross-site scripting (XSS) vulnerabilities in main.php in phpAlbum 0.4.1.16 and earlier allow remote
- CVE-2011-3770 MEDIUM 5.0 DOWNGRADE phpAlbum 0.4.1.14 allows remote attackers to obtain sensitive information via a direct request to a .php file,
- CVE-2007-1456 HIGH 7.5 MITIGATE PHP remote file inclusion vulnerability in common.php in PHP Photo Album allows remote attackers to execute ar
- CVE-2006-4498 HIGH 7.5 DOWNGRADE PHP remote file inclusion vulnerability in sommaire_admin.php in PhpAlbum (mod_phpalbum) 2.15 for PortailPHP a