CVE-2006-4625

PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server...

3.6 LowPublic exploit

PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.

Exploit likelihood

1.19%Down 2.0 points since Feb 4, 2022

What each source reports

NVD Score used 3.6

Record: CVE-2006-4625
CVSS 2.0: 3.6 LowAV:L/AC:L/Au:N/C:P/I:P/A:N
Updated: 2026-11-02

CVE List No score

Record: CVE-2006-4625
Updated: 2026-11-02

EUVDEUVD-2006-4613 No score

Record: EUVD-2006-4613
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jh35-xrpp-vv4q No score

PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server...

Record: GHSA-jh35-xrpp-vv4q
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	PHP 3 < 5 - Ini_Restore() 'Safe_mode' / 'open_basedir' Restriction Bypass	2006-09-09

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-4625 is a low vulnerability (CVSS 3.6) in Php, published September 12, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. No source names a fixed version.

References

Show 17 moreShow less