Unrated severityNVD Advisory· Published Jun 20, 2008· Updated Apr 23, 2026
CVE-2008-2666
CVE-2008-2666
Description
Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.
Affected products
23cpe:2.3:a:php:php:*:*:*:*:*:*:*:*+ 22 more
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*range: <=5.2.6
- cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
17- www.us-cert.gov/cas/techalerts/TA09-133A.htmlnvdUS Government Resource
- lists.apple.com/archives/security-announce/2009/May/msg00002.htmlnvd
- marc.infonvd
- marc.infonvd
- secunia.com/advisories/32746nvd
- secunia.com/advisories/35074nvd
- secunia.com/advisories/35650nvd
- security.gentoo.org/glsa/glsa-200811-05.xmlnvd
- securityreason.com/achievement_securityalert/55nvd
- securityreason.com/securityalert/3942nvd
- support.apple.com/kb/HT3549nvd
- wiki.rpath.com/Advisories:rPSA-2009-0035nvd
- www.securityfocus.com/archive/1/501376/100/0/threadednvd
- www.securityfocus.com/bid/29796nvd
- www.securitytracker.com/idnvd
- www.vupen.com/english/advisories/2009/1297nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/43198nvd
News mentions
0No linked articles in our index yet.