CVE-2006-5327

CVE-2006-5327 describes an untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, including its use in Apple Xcode 2.2 and earlier. This flaw allows a local attacker to execute arbitrary code by manipulating the PATH environment variable to point to a malicious gzip program, which is then executed by gnutar when invoked by OpenBase under specific TAR_OPTIONS settings. The vulnerability carries a CVSS score of 7.2 (High), indicating a local attack vector with low attack complexity and no authentication required, leading to complete compromise of confidentiality, integrity, and availability. Its EPSS score is very low, suggesting a minimal probability of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code is available via Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered no community discussion or media coverage, indicating a low level of public attention.