CVE-2006-3934
Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
Exploit likelihood
What each source reports
NVD Score used
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
- Record
CVE-2006-3934- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
- Record
CVE-2006-3934- Updated
- 2026-11-02
EUVDEUVD-2006-3928 No score
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
- Record
EUVD-2006-3928- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-64hc-4jx3-62jp
Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
- Record
GHSA-64hc-4jx3-62jp- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-64hc-4jx3-62jp
Alkacon OpenCMS Absolute Path Traversal via pathname in filePath parameter
Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.
- Record
GHSA-64hc-4jx3-62jp- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opencms:opencms-coreMaven |
before 6.2.2 | 6.2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3934 is a medium vulnerability (CVSS 4.0) in Alkacon Opencms, published July 31, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 73rd percentile. Fixed in org.opencms:opencms-core 6.2.2.