VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 18, 2006· Updated Jun 16, 2026

CVE-2006-6629

CVE-2006-6629

Description

lib/WeBWorK/PG/Translator.pm in WeBWorK Program Generation (PG) Language before 2.3.1 uses an insufficiently restrictive regular expression to determine valid macro filenames, which allows attackers to load arbitrary macro files whose names contain the strings (1) dangerousMacros.pl, (2) PG.pl, or (3) IO.pl.

Affected products

2
  • Webwork/Program Generation Language2 versions
    cpe:2.3:a:webwork:program_generation_language:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:webwork:program_generation_language:*:*:*:*:*:*:*:*range: <=2.3
    • (no CPE)range: <2.3.1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.