CVE-2005-4467

CVE-2005-4467 describes a directory traversal vulnerability in PHPGedView versions 3.3.7 and earlier, specifically within the help_text_vars.php component. This flaw allows unauthenticated remote attackers to read and potentially include arbitrary files on the server by manipulating the PGV_BASE_DIRECTORY parameter with dot-dot-slash sequences. The vulnerability carries a CVSS score of 5.0, indicating a medium severity. It is easily exploitable over the network with low attack complexity, requiring no authentication, and primarily impacts confidentiality by allowing unauthorized file access. While the NVD vector suggests only confidentiality impact, exploit intelligence indicates potential for remote code execution. Despite its age, there is an ExploitDB entry (EDB-1379) demonstrating remote code execution for this vulnerability, suggesting practical exploitability beyond simple file reading. However, it is not listed on the CISA KEV catalog, and there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.