CVE-2006-3608

The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled,...

4.6 MediumPublic exploit

The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled, does not restrict the extensions of uploaded files that begin with a GIF header, which allows remote authenticated users to execute arbitrary PHP code via an uploaded .php file.

Exploit likelihood

2.26%Down 3.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.6

Record: CVE-2006-3608
CVSS 2.0: 4.6 MediumAV:N/AC:H/Au:S/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2006-3608
Updated: 2026-11-02

EUVDEUVD-2006-3603 No score

Record: EUVD-2006-3603
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rr9c-438j-jfpx No score

The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled,...

Record: GHSA-rr9c-438j-jfpx
Updated: 2026-11-02

Affected products

flatnuke

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	FlatNuke 2.5.7 - 'index.php' Remote File Inclusion	2006-07-13

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-3608 is a medium vulnerability (CVSS 4.6) in Flatnuke, published July 14, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.26%, the 83rd percentile. No source names a fixed version.