CVE-2006-2186: Zenphoto

Medium severity, CVSS 5.0. EPSS: 1.5% chance of exploitation in the next 30 days.

zenphoto 1.0.1 beta and earlier allow remote attackers to obtain sensitive information via a direct request for the (1) /photos/themes/default/ and (2) /photos/themes/testing/ URIs, which reveals the path in an error message.

Affected products

• Zenphoto Zenphoto: version 0.9 only; version 1.0.1_beta only; version 1.0_beta only

Published 2006-05-04. Last modified 2026-06-16.