CVE-2006-4859: Limbo CMS

High severity, CVSS 7.5. EPSS: 7.4% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in contact.html.php in the Contact (com_contact) component in Limbo (aka Lite Mambo) CMS 1.0.4.2L and earlier allows remote attackers to upload PHP code to the images/contact folder via a filename with a double extension in the contact_attach parameter in a contact option in index.php, which bypasses an insufficiently restrictive regular expression.

Affected products

• Limbo CMS Limbo CMS: version 1.0.4.1 only; version 1.0.4.2 only; version 1.0.4.2l only

Published 2006-09-19. Last modified 2026-06-16.