CVE-2006-1219: Gallery Project Gallery

Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days.

Directory traversal vulnerability in Gallery 2.0.3 and earlier, and 2.1 before RC-2a, allows remote attackers to include arbitrary PHP files via ".." (dot dot) sequences in the stepOrder parameter to (1) upgrade/index.php or (2) install/index.php.

Affected products

• Gallery Project Gallery: version 2.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0_alpha only; version 2.0_alpha1 only; …

Published 2006-03-14. Last modified 2026-06-16.