CVE-2006-3934

Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.

• CWE-22

• http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txtExploit, Patch
• http://secunia.com/advisories/21193Exploit, Patch, Vendor Advisory
• http://securityreason.com/securityalert/1302
• http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zipPatch
• http://www.opencms.org/opencms/en/shownews.html?id=1002Patch
• http://www.securityfocus.com/archive/1/441182/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28000
• http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txtExploit, Patch
• http://secunia.com/advisories/21193Exploit, Patch, Vendor Advisory
• http://securityreason.com/securityalert/1302
• http://www.opencms.org/export/download/opencms/opencms_6.2.2_src.zipPatch
• http://www.opencms.org/opencms/en/shownews.html?id=1002Patch
• http://www.securityfocus.com/archive/1/441182/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28000

Published

Jul 31, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3928PHP remote file inclusion vulnerability in index.php in WMNe…
• CVE-2006-3929Cross-site scripting (XSS) vulnerability in the Forms/rpSysA…
• CVE-2006-3930PHP remote file inclusion vulnerability in admin.a6mambohelp…
• CVE-2006-3931Buffer overflow in the daemon function in midirecord.cc in T…
• CVE-2006-3932SQL injection vulnerability in links.php in Gonafish LinksCa…
• CVE-2006-3933Cross-site scripting (XSS) vulnerability in Alkacon OpenCms …
• CVE-2006-3935system/workplace/views/admin/admin-main.jsp in Alkacon OpenC…
• CVE-2006-3936system/workplace/editors/editor.jsp in Alkacon OpenCms befor…
• CVE-2006-3937post.php in x_atrix xGuestBook 1.02 allows remote attackers …
• CVE-2006-3938DotClear allows remote attackers to obtain sensitive informa…
• CVE-2006-3939ScriptsCenter ezUpload Pro 2.2.0 allows remote attackers to …
• CVE-2006-3940Multiple SQL injection vulnerabilities in phpbb-Auction allo…