CVE-2005-4086

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-08 · updated 2026-06-16

Description

Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management (SugarCRM) 4.0 beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the beanFiles array parameter.

Affected products

SugarCRM Sugar Suite: 3.5, 4.0_beta

References

http://rgod.altervista.org/sugar_suite_40beta.html
http://secunia.com/advisories/17948
http://securitytracker.com/id?1015322
http://www.securityfocus.com/archive/1/418840
http://www.securityfocus.com/bid/15760
http://www.vupen.com/english/advisories/2005/2800
http://rgod.altervista.org/sugar_suite_40beta.html
http://secunia.com/advisories/17948
http://securitytracker.com/id?1015322
http://www.securityfocus.com/archive/1/418840
http://www.securityfocus.com/bid/15760
http://www.vupen.com/english/advisories/2005/2800

Get alerted when CVE-2005-4086 or the next vulnerability affects your stack