GitHub Advisoryadvisory · Maven
GHSA-64hc-4jx3-62jp Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter
MEDIUM
Official page ↗
- Aliases
- CVE-2006-3934
- Ecosystem
- Maven
- Packages
- org.opencms:opencms-core
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
- Weaknesses
- CWE-22
- Reviewed
- 2025-06-20
Affected packages
• Maven org.opencms:opencms-core: < 6.2.2 → fixed in 6.2.2
Description
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
Related
Alias · CVE (1)
- CVE-2006-3934 Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2006-3934 advisory
- https://github.com/alkacon/opencms-core/commit/8f1c04c5a16fe8d0bdbd13b65bf2a7b5cf100ff9 web
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28000 web
- https://github.com/alkacon/opencms-core package
- http://securityreason.com/securityalert/1302 web
- http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zip web
- http://www.opencms.org/opencms/en/shownews.html?id=1002 web