CVE-2006-3360
phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence
Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
- Record
CVE-2006-3360- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
- Record
CVE-2006-3360- Updated
- 2026-11-02
EUVDEUVD-2022-2067 No score
Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
- Record
EUVD-2022-2067- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2wxv-3g4v-p76p No score
phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence
Directory traversal vulnerability in index.php in phpSysInfo prior to 3.2.5 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
- Record
GHSA-2wxv-3g4v-p76p- Weakness
- CWE-22
- Updated
- 2026-11-02
OSV No score
Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
- Record
CVE-2006-3360- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-3360 No score
Directory traversal vulnerability in index.php in phpSysInfo 2.5.1 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
- Record
DEBIAN-CVE-2006-3360- Updated
- 2026-11-02
OSVGHSA-2wxv-3g4v-p76p No score
phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence
Directory traversal vulnerability in index.php in phpSysInfo prior to 3.2.5 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
- Record
GHSA-2wxv-3g4v-p76p- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpsysinfo/phpsysinfoPackagist |
before 3.2.5 | 3.2.5 |
phpsysinfoDebian:12 |
before 3.2.5-3 | 3.2.5-3 |
phpsysinfoDebian:13 |
before 3.2.5-3 | 3.2.5-3 |
phpsysinfoDebian:14 |
before 3.2.5-3 | 3.2.5-3 |
phpsysinfo/phpsysinfoPackagist |
before 3.2.5, plus listed versions v3.1.13v3.1.14v3.1.15v3.1.16v3.1.17 Show 5 moreShow lessv3.2.0v3.2.1v3.2.2v3.2.3v3.2.4 |
3.2.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3360 is a medium vulnerability (CVSS 5.0) in Phpsysinfo, published July 6, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.57%, the 92nd percentile. Fixed in phpsysinfo/phpsysinfo 3.2.5.
References
securitytracker.com/id?1016440
exchange.xforce.ibmcloud.com/vulnerabilities/27527
vupen.com/english/advisories/2006/2668
osvdb.org/27015
secunia.com/advisories/20939
archives.neohapsis.com/archives/fulldisclosure/2006-07/0066.html
Show 9 moreShow less
securityfocus.com/bid/18868
github.com/advisories/GHSA-2wxv-3g4v-p76p
nvd.nist.gov/vuln/detail/CVE-2006-3360
security-tracker.debian.org/tracker/CVE-2006-3360