CVE-2006-7204: PHP

Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The imap_body function in PHP before 4.4.4 does not implement safemode or open_basedir checks, which allows local users to read arbitrary files or list arbitrary directory contents.

Affected products

• PHP PHP: from 4.4.0, before 4.4.4 (fixed in 4.4.4); from 5.1.0, before 5.1.5 (fixed in 5.1.5)

Published 2007-05-22. Last modified 2026-06-16.