CVE-2006-5210: Ciphertrust Ironmail

Medium severity, CVSS 5.0. EPSS: 4.3% chance of exploitation in the next 30 days.

Directory traversal vulnerability in IronWebMail before 6.1.1 HotFix-17 allows remote attackers to read arbitrary files via a GET request to the IM_FILE identifier with double-url-encoded "../" sequences ("%252e%252e/").

Affected products

• Ciphertrust Ironmail: up to and including 6.1.1; version 4.1 only; version 4.5.1 only; version 5.0.1 only

Published 2006-10-16. Last modified 2026-06-16.