CVE-2006-6678
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify...
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
Exploit likelihood
What each source reports
NVD Score used
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
- Record
CVE-2006-6678- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
- Record
CVE-2006-6678- Updated
- 2026-11-02
EUVDEUVD-2006-6661 No score
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
- Record
EUVD-2006-6661- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-37rp-7j34-hmr2 No score
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify...
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
- Record
GHSA-37rp-7j34-hmr2- Updated
- 2026-11-02
OSV No score
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
- Record
CVE-2006-6678- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-6678 No score
The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.
- Record
DEBIAN-CVE-2006-6678- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-6678 is a high vulnerability (CVSS 7.5) in Netrik, published December 21, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in netrik 1.15.3-1.1.
References
debian.org/security/2007/dsa-1251
securityfocus.com/bid/22158
vupen.com/english/advisories/2006/5092
netrik.cvs.sourceforge.net/netrik/netrik/form-file.c?r1=1.3&r2=1.4
sourceforge.net/project/shownotes.php?release_id=472131&group_id=23183
secunia.com/advisories/23822
nvd.nist.gov/vuln/detail/CVE-2006-6678
github.com/advisories/GHSA-37rp-7j34-hmr2
security-tracker.debian.org/tracker/CVE-2006-6678