Skip to content

CVE-2006-4246

Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related...

3.6 LowFix available

CVE-2006-4246 is a low vulnerability (CVSS 3.6) in Usermin, published September 15, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in usermin 1.110-3.1.

Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user.

Exploit likelihood

0.88%Down 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 3.6

Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user.

Record: CVE-2006-4246
CVSS 2.0: 3.6 LowAV:L/AC:L/Au:N/C:P/I:N/A:P
Updated: 2026-11-02

CVE List No score

Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user.

Record: CVE-2006-4246
Updated: 2026-11-02

EUVDEUVD-2006-4236 No score

Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user.

Record: EUVD-2006-4236
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4qxm-xm9h-rhmg No score

Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related...

Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user.

Record: GHSA-4qxm-xm9h-rhmg
Updated: 2026-11-02

Affected products

usermin

Affected packages

Affected packages
Package	Affected	Fixed
`usermin` Debian:3.1	before 1.110-3.1, plus listed versions 1.110-3	1.110-3.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 5 moreShow less