CVE-2006-6599

CVE-2006-6599 describes a remote command execution vulnerability in TorrentFlux 2.2, specifically within the maketorrent.php script. An authenticated attacker can inject shell metacharacters, such as a semicolon, into the "announce" parameter to execute arbitrary commands on the server. This vulnerability carries a CVSS score of 6.0, indicating a medium severity due to requiring authentication and moderate attack complexity, but potentially leading to partial confidentiality, integrity, and availability compromise. While not listed in CISA's KEV catalog, exploit code is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.