CVE-2006-2849: Andrew Godwin Bytehoard

High severity, CVSS 7.5. EPSS: 11.5% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in includes/webdav/server.php in Bytehoard 2.1 Epsilon/Delta allows remote attackers to execute arbitrary PHP code via a URL in the bhconfig[bhfilepath] parameter.

Affected products

• Andrew Godwin Bytehoard: version 2.1_delta only; version 2.1_epsilon only

Published 2006-06-06. Last modified 2026-06-16.