CVE-2006-3336

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-07-05 · updated 2026-06-16

Description

TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt. NOTE: this is only a vulnerability when the server allows script execution in the pub directory.

Affected products

Twiki: 4.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 2000-12-01 (+7)

References

http://secunia.com/advisories/20992
http://securitytracker.com/id?1016458
http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads
http://www.securityfocus.com/bid/18854
http://www.vupen.com/english/advisories/2006/2677
http://secunia.com/advisories/20992
http://securitytracker.com/id?1016458
http://twiki.org/cgi-bin/view/Codev/SecurityAlertSecureFileUploads
http://www.securityfocus.com/bid/18854
http://www.vupen.com/english/advisories/2006/2677

Get alerted when CVE-2006-3336 or the next vulnerability affects your stack