CVE-2006-2644: Awstats

Medium severity, CVSS 4.0. EPSS: 2.7% chance of exploitation in the next 30 days.

AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload a configuration file whose name contains shell metacharacters, then access that file using the LogFile directive.

Affected products

• Awstats Awstats: version 6.4_1 only; version 6.5 only; version 6.5_1 only

Published 2006-05-30. Last modified 2026-06-16.