CVE-2006-4248
thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or...
thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the start_thttpd temporary file.
Exploit likelihood
What each source reports
NVD Score used
thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the start_thttpd temporary file.
- Record
CVE-2006-4248- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the start_thttpd temporary file.
- Record
CVE-2006-4248- Updated
- 2026-11-02
EUVDEUVD-2006-4237 No score
thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the start_thttpd temporary file.
- Record
EUVD-2006-4237- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5h6r-qg95-jx6w No score
thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or...
thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the start_thttpd temporary file.
- Record
GHSA-5h6r-qg95-jx6w- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thttpdDebian:3.1 |
before 2.23beta1-3sarge2, plus listed versions 2.23beta1-32.23beta1-3sarge1 |
2.23beta1-3sarge2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-4248 is a high vulnerability (CVSS 7.2) in Acme Labs Thttpd, published October 31, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in thttpd 2.23beta1-3sarge2.