CVE-2006-1480

CVE-2006-1480 is a directory traversal vulnerability in WebAlbum 2.02's start.php, allowing remote attackers to include arbitrary files and execute commands. This is achieved by injecting code into local log files via GET requests, then accessing those logs using a dot-dot sequence and a null byte in the 'skin2' COOKIE parameter. The vulnerability has a CVSS score of 5.1 (medium severity) with a network attack vector, high access complexity, and partial impact on confidentiality, integrity, and availability. While not listed on CISA's KEV catalog or the Hot List, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.