CVE-2008-2665: Path Traversal

Published Jun 20, 2008

Updated

Directory traversal vulnerability in the posixaccess function in PHP 5.2.6 and earlier allows remote attackers to bypass safemode restrictions via a .. (dot dot) in an http URL, which results in the URL being canonicalized to a local filename after the safemode check has successfully run.

Affected Software

1 affected component

PHP PHP=5.2.6

Event History

Jun 20, 2008

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2665?

CVE-2008-2665 is classified as a critical vulnerability due to its potential to allow remote attackers to bypass safe_mode restrictions.

How do I fix CVE-2008-2665?

To fix CVE-2008-2665, upgrade to PHP version 5.2.7 or later, which includes the necessary patches to address this vulnerability.

What software is affected by CVE-2008-2665?

CVE-2008-2665 affects PHP version 5.2.6 and earlier.

What kind of attack does CVE-2008-2665 enable?

CVE-2008-2665 enables directory traversal attacks that could lead to unauthorized file access on the server.

Is CVE-2008-2665 present in later versions of PHP?

No, CVE-2008-2665 does not exist in PHP versions later than 5.2.6, as the vulnerability was addressed in subsequent updates.