CVE-2006-6533: Oscommerce

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in admin/templates_boxes_layout.php in osCommerce 3.0a3 allows remote attackers to include and execute arbitrary PHP files via a .. (dot dot) in the filter parameter. NOTE: this issue can be leveraged to obtain full path information in error messages.

Affected products

• Oscommerce Oscommerce: version 3.0a3 only

Published 2006-12-14. Last modified 2026-06-16.