CVE-2007-2659: Bugada Andrea PHP Advanced Transfer Manager

Medium severity, CVSS 5.0. EPSS: 6.8% chance of exploitation in the next 30 days.

Directory traversal vulnerability in index.php in PHP Advanced Transfer Manager (phpATM) 1.30 allows remote attackers to read arbitrary files and obtain script source code via a .. (dot dot) in the directory parameter in a downloadfile action.

Affected products

• Bugada Andrea PHP Advanced Transfer Manager: version 1.30 only

Published 2007-05-14. Last modified 2026-06-16.