CVE-2006-1608: PHP

Low severity, CVSS 2.1. EPSS: 1.1% chance of exploitation in the next 30 days.

The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.

Affected products

• PHP PHP: version 4.0 only; version 4.0.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only; …

Published 2006-04-10. Last modified 2026-06-16.