Multiple PHP remote file inclusions in Ariadne 2.4.1 allows remote attackers to execute arbitrary PHP code via the ariadne parameter in…

Description

Multiple PHP remote file inclusions in Ariadne 2.4.1 allows remote attackers to execute arbitrary PHP code via the ariadne parameter in (1) ftp/loader.php and (2) lib/includes/loader.cmd.php. NOTE: this issue is disputed by CVE, since installation instructions recommend that the files be placed outside of the web document root and require the administrator to modify $ariadne in an include file

Scores

EPSS (exploitation in 30 days)

1.9% · top 20% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (6)

• ariadne-storeconfig-file-include(30018) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 20061106 RE: DISPUTE: PHP file inclusion in Ariadne 2.4.1 (opens in a new tab)mailing-listx_refsource_VIMx_transferred
• 20916 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 1827 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
• 20061106 Ariadne <= 2.4.1 Multiple Remote File Include Vulnerabilities(New) (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 20061106 DISPUTE: PHP file inclusion in Ariadne 2.4.1 (opens in a new tab)mailing-listx_refsource_VIMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-5776](https://trackcve.app/badge/CVE-2006-5776.svg)](https://trackcve.app/cve/CVE-2006-5776)

Record last updated 7 Aug 2024, 20:04 UTC.