CVE-2006-3934: Alkacon Opencms

Medium severity, CVSS 4.0. EPSS: 1.5% chance of exploitation in the next 30 days.

Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote authenticated users to download arbitrary files via an absolute pathname in the filePath parameter.

Affected products

• Alkacon Opencms: up to and including 6.2.1; version 6.0.0 only; version 6.0.2 only; version 6.0.3 only; version 6.0.4 only; version 6.2 only

Published 2006-07-31. Last modified 2026-06-16.