CVE-2006-4432

Directory traversal vulnerability in Zend Platform 2.2.1 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in the final component of the PHP session identifier (PHPSESSID). NOTE: in some cases, this issue can be leveraged to perform direct static code injection.

• http://secunia.com/advisories/21573Patch, Vendor Advisory
• http://securityreason.com/securityalert/1466
• http://www.hardened-php.net/advisory_052006.128.htmlPatch, Vendor Advisory
• http://www.osvdb.org/28232
• http://www.securityfocus.com/archive/1/444263/100/0/threaded
• http://www.vupen.com/english/advisories/2006/3388
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28576
• http://secunia.com/advisories/21573Patch, Vendor Advisory
• http://securityreason.com/securityalert/1466
• http://www.hardened-php.net/advisory_052006.128.htmlPatch, Vendor Advisory
• http://www.osvdb.org/28232
• http://www.securityfocus.com/archive/1/444263/100/0/threaded
• http://www.vupen.com/english/advisories/2006/3388
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28576

Published

Aug 29, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4426PHP remote file inclusion vulnerability in AES/modules/auth/…
• CVE-2006-4427index.php in eFiction before 2.0.7 allows remote attackers t…
• CVE-2006-4428PHP remote file inclusion vulnerability in index.php in Jupi…9.8
• CVE-2006-4429PHP remote file inclusion vulnerability in handlers/email/mo…
• CVE-2006-4430The Cisco Network Admission Control (NAC) 3.6.4.1 and earlie…
• CVE-2006-4431Multiple buffer overflows in the (a) Session Clustering Daem…
• CVE-2006-4433PHP before 4.4.3 and 5.x before 5.1.4 does not limit the cha…
• CVE-2006-4434Use-after-free vulnerability in Sendmail before 8.13.8 allow…7.5
• CVE-2006-4435OpenBSD 3.8, 3.9, and possibly earlier versions allows conte…
• CVE-2006-4436isakmpd in OpenBSD 3.8, 3.9, and possibly earlier versions, …
• CVE-2006-4437Eval injection vulnerability in Tagger LE allows remote atta…
• CVE-2006-4438Heap-based buffer overflow in SpIDer for Dr.Web Scanner for …