CVE-2006-6879: PHP-Update

Medium severity, CVSS 6.0. EPSS: 1.9% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in admin/uploads.php in PHP-Update 2.7 and earlier allows remote authenticated users to upload arbitrary PHP scripts to the gfx/ and files/ directories via the userfile parameter.

Affected products

• PHP-Update PHP-Update: up to and including 2.7

Published 2006-12-31. Last modified 2026-06-16.