CVE-2006-3128: Easy-CMS

Medium severity, CVSS 4.6. EPSS: 1.2% chance of exploitation in the next 30 days.

choose_file.php in easy-CMS 0.1.2, when mod_mime is installed, does not restrict uploads of filenames with multiple extensions, which allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a GIF file extension, then directly accessing that file in the Repositories directory.

Affected products

• Easy-CMS Easy-CMS: version 0.1.2 only

Published 2006-06-21. Last modified 2026-06-16.