CVE-2006-4558: Deluxebb

High severity, CVSS 7.5. EPSS: 4.3% chance of exploitation in the next 30 days.

DeluxeBB 1.06 and earlier, when run on the Apache HTTP Server with the mod_mime module, allows remote attackers to execute arbitrary PHP code by uploading files with double extensions via the fileupload parameter in a newthread action in newpost.php.

Affected products

• Deluxebb Deluxebb: up to and including 1.06

Published 2006-09-06. Last modified 2026-06-16.