CVE-2006-5858

CVE-2006-5858 describes a critical vulnerability in Adobe ColdFusion MX 7 (up to 7.0.2) and JRun 4, specifically when deployed with Microsoft IIS. This flaw permits remote attackers to read arbitrary files, list directories, or view source code by exploiting a double URL-encoded NULL byte within a ColdFusion filename. The vulnerability carries a CVSS score of 5.0, indicating a medium severity. It is easily exploitable over the network with low attack complexity and no authentication required, leading to a potential impact of information disclosure. Despite its age and potential for information disclosure, there is no evidence of active exploitation, nor are there readily available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are virtually nonexistent, suggesting a low level of public awareness or current threat.