CVE-2007-4092: Ifoto

Medium severity, CVSS 5.0. EPSS: 2.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in index.php in iFoto 1.0.1 and earlier allows remote attackers to list arbitrary directories, and possibly download arbitrary photos, via a .. (dot dot) in the dir parameter.

Affected products

• Ifoto Ifoto: up to and including 1.0.1

Published 2007-07-30. Last modified 2026-06-16.