CVE-2006-5031

CVE-2006-5031 describes a directory traversal vulnerability in CakePHP versions prior to 1.1.8.3544, specifically within the app/webroot/js/vendors.php component. This flaw allows unauthenticated remote attackers to read arbitrary files on the server by manipulating the 'file' parameter with dot-dot sequences, a null byte, and a .js extension. With a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N), it indicates a network-exploitable vulnerability with low attack complexity, resulting in potential information disclosure. While not listed on CISA's KEV catalog, an ExploitDB entry (EDB-28645) confirms the existence of exploit code, though there is no evidence of active exploitation, Metasploit/Nuclei modules, or significant community discussion or media coverage.