CVE-2006-1594
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and...
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.
- Record
CVE-2006-1594- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.
- Record
CVE-2006-1594- Updated
- 2026-11-02
EUVDEUVD-2006-1595 No score
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.
- Record
EUVD-2006-1595- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rgp9-x7vj-r9h2 No score
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and...
Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use ".." (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.
- Record
GHSA-rgp9-x7vj-r9h2- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-1594 is a high vulnerability (CVSS 7.5) in Claroline, published April 3, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.06%, the 92nd percentile. No source names a fixed version.
References
retrogod.altervista.org/claroline_174_incl_xpl.html
secunia.com/advisories/19461
securityfocus.com/bid/17343
vupen.com/english/advisories/2006/1187
exchange.xforce.ibmcloud.com/vulnerabilities/25561
exploit-db.com/exploits/1627
nvd.nist.gov/vuln/detail/CVE-2006-1594
github.com/advisories/GHSA-rgp9-x7vj-r9h2