CVE-2016-6614

An issue was discovered in phpMyAdmin involving the %u username replacement functionality of the SaveDir and UploadDir features. When the username substitution is configured, a specially-crafted user name can be used to circumvent restrictions to traverse the file system. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

• CWE-22

• http://www.securityfocus.com/bid/94366Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-37Patch, Vendor Advisory
• http://www.securityfocus.com/bid/94366Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-37Patch, Vendor Advisory

Published

Dec 11, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6608XSS issues were discovered in phpMyAdmin. This affects the d…
• CVE-2016-6609An issue was discovered in phpMyAdmin. A specially crafted d…
• CVE-2016-6610A full path disclosure vulnerability was discovered in phpMy…
• CVE-2016-6611An issue was discovered in phpMyAdmin. A specially crafted d…
• CVE-2016-6612An issue was discovered in phpMyAdmin. A user can exploit th…
• CVE-2016-6613An issue was discovered in phpMyAdmin. A user can specially …
• CVE-2016-6615XSS issues were discovered in phpMyAdmin. This affects navig…
• CVE-2016-6616An issue was discovered in phpMyAdmin. In the "User group" a…
• CVE-2016-6617An issue was discovered in phpMyAdmin. A specially crafted d…
• CVE-2016-6618An issue was discovered in phpMyAdmin. The transformation fe…
• CVE-2016-6619An issue was discovered in phpMyAdmin. In the user interface…
• CVE-2016-6620An issue was discovered in phpMyAdmin. Some data is passed t…