CVE-2006-5097
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in net2ftp, possibly 0.1...
PHP remote file inclusion vulnerability in index.php in net2ftp, possibly 0.1 through 0.62, allows remote attackers to execute arbitrary PHP code via a URL in the application_rootdir parameter. NOTE: this issue has been disputed by a third party researcher, CVE, and the vendor. The vendor says "the variable is set in settings.inc.php, so this is not a vulnerability.
Exploit likelihood
What each source reports
NVD Score used
PHP remote file inclusion vulnerability in index.php in net2ftp, possibly 0.1 through 0.62, allows remote attackers to execute arbitrary PHP code via a URL in the application_rootdir parameter. NOTE: this issue has been disputed by a third party researcher, CVE, and the vendor. The vendor says "the variable is set in settings.inc.php, so this is not a vulnerability.
- Record
CVE-2006-5097- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
PHP remote file inclusion vulnerability in index.php in net2ftp, possibly 0.1 through 0.62, allows remote attackers to execute arbitrary PHP code via a URL in the application_rootdir parameter. NOTE: this issue has been disputed by a third party researcher, CVE, and the vendor. The vendor says "the variable is set in settings.inc.php, so this is not a vulnerability.
- Record
CVE-2006-5097- Updated
- 2026-11-02
EUVDEUVD-2006-5082 No score
PHP remote file inclusion vulnerability in index.php in net2ftp, possibly 0.1 through 0.62, allows remote attackers to execute arbitrary PHP code via a URL in the application_rootdir parameter. NOTE: this issue has been disputed by a third party researcher, CVE, and the vendor. The vendor says "the variable is set in settings.inc.php, so this is not a vulnerability.
- Record
EUVD-2006-5082- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-58rr-xmg9-55j4 No score
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in net2ftp, possibly 0.1...
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in net2ftp, possibly 0.1 through 0.62, allows remote attackers to execute arbitrary PHP code via a URL in the application_rootdir parameter. NOTE: this issue has been disputed by a third party researcher, CVE, and the vendor. The vendor says "the variable is set in settings.inc.php, so this is not a vulnerability."
- Record
GHSA-58rr-xmg9-55j4- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-5097 is a high vulnerability (CVSS 7.5) in Net2ftp, published September 29, 2006. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 3.94%, the 90th percentile.
References
net2ftp.org/forums/viewtopic.php?pid=6689
securityfocus.com/archive/1/447535/100/0/threaded
attrition.org/pipermail/vim/2006-October/001077.html
Show 7 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/29203
securityreason.com/securityalert/1655
nvd.nist.gov/vuln/detail/CVE-2006-5097
github.com/advisories/GHSA-58rr-xmg9-55j4