CVE-2006-1292 describes a directory traversal vulnerability in PHP iCalendar versions 2.21 and earlier. This flaw allows unauthenticated remote attackers to include and execute arbitrary local files by manipulating cookie values, specifically phpicalendar[cookie_language] and phpicalendar[cookie_style], with directory traversal sequences and a null byte. With a CVSS score of 5.0, this vulnerability has a low attack complexity and can lead to unauthorized information disclosure or remote code execution, as demonstrated by injecting PHP into Apache access logs. While not listed in CISA KEV, public exploit code exists, and its FAUCET Risk Score of 83/100 indicates a significant risk despite limited community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.2.1CPE matchmatch criteria | cpe:2.3:a:php_icalendar:php_icalendar:*:*:*:*:*:*:*:* | ||
2.0CPE matchmatch criteria | cpe:2.3:a:php_icalendar:php_icalendar:2.0:*:*:*:*:*:*:* | ||
2.0.1CPE matchmatch criteria | cpe:2.3:a:php_icalendar:php_icalendar:2.0.1:*:*:*:*:*:*:* | ||
2.0a2CPE matchmatch criteria | cpe:2.3:a:php_icalendar:php_icalendar:2.0a2:*:*:*:*:*:*:* | ||
2.0bCPE matchmatch criteria | cpe:2.3:a:php_icalendar:php_icalendar:2.0b:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.