CVE-2007-6479: Dokeos

Medium severity, CVSS 4.9. EPSS: 1.6% chance of exploitation in the next 30 days.

Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php (aka the "My profile" page) in Dokeos 1.8.4 allows remote authenticated users to upload and execute arbitrary PHP files via a filename with a double extension, which can then be accessed through a URI under main/upload/users/.

Affected products

• Dokeos Dokeos: version 1.8.4 only

Published 2007-12-20. Last modified 2026-06-16.