Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2006-7159: Directory traversal vulnerability in include/prune_torrents.php in BTI-Tracker 1.3.2 (aka btitracker) allows r

41
This month
MEDIUM 6.4DOWNGRADEDOWNGRADE

CVE-2006-7159 is a medium-severity flaw (CVSS 6.4) affecting bti-tracker, btitracker. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Directory traversal vulnerability in include/prune_torrents.php in BTI-Tracker 1.3.2 (aka btitracker) allows remote attackers to delete arbitrary files via ".." sequences in the TORRENTSDIR parameter in a prune action.

Why this priority

  • No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score6.4 (Medium)
EPSS exploit chance1.5% (top 25%)
CISA exploited listNo
Published2007-03-07
Last modified2026-06-16
Publisher (CNA): MITRE · Vendor: bti-tracker · btitracker

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

bti-tracker bti-tracker DOWNGRADE
Affected: 1.3.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.3.2
1. Check installed version
apt-cache policy bti-tracker || rpm -q bti-tracker || bti-tracker --version
2. No fixed release: DOWNGRADE to a release before 1.3.2 (Debian / Ubuntu)
apt-cache madison bti-tracker sudo apt install bti-tracker=<VERSION_BEFORE_1.3.2> sudo apt-mark hold bti-tracker
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list bti-tracker sudo dnf downgrade bti-tracker-<VERSION_BEFORE_1.3.2> sudo dnf versionlock add bti-tracker
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
btitracker btitracker DOWNGRADE
Affected: 1.3.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.3.2
1. Check installed version
apt-cache policy btitracker || rpm -q btitracker || btitracker --version
2. No fixed release: DOWNGRADE to a release before 1.3.2 (Debian / Ubuntu)
apt-cache madison btitracker sudo apt install btitracker=<VERSION_BEFORE_1.3.2> sudo apt-mark hold btitracker
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list btitracker sudo dnf downgrade btitracker-<VERSION_BEFORE_1.3.2> sudo dnf versionlock add btitracker
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-7159?

bti-tracker: downgrade or apply the listed mitigation; btitracker: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2006-7159 being exploited?

CVE-2006-7159 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-7159 affect?

CVE-2006-7159 affects bti-tracker, btitracker. Severity is medium (CVSS 6.4). Directory traversal vulnerability in include/prune_torrents.php in BTI-Tracker 1.3.2 (aka btitracker) allows remote attackers to delete arbitrary files via ".." sequences in the TORRENTSDIR parameter in a prune action.

How urgent is CVE-2006-7159?

Priority 41/100. No elevated risk signals yet.

Software pages

PHP vulnerabilities

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.