CVE-2006-0818
CVE-2006-0818 is a medium-severity vulnerability in Deerfield Visnetic Mail Server with a CVSS 2.0 base score of 4.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 2.0 base score 4.0)
- EPSS exploit prediction: 2% (79th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Deerfield Visnetic Mail Server
- Published:
- Last modified:
Description
Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558.
Frequently asked questions
- What is CVE-2006-0818?
- Absolute path directory traversal vulnerability in (1) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web Mail 5.6.1 and (2) VisNetic MailServer before 8.5.0.5 allows remote authenticated users to include arbitrary files via a modified language parameter and a full Windows or UNC pathname in the lang_settings parameter to mail/index.html, which is not properly sanitized by the validatefolder PHP function, possibly due to an incomplete fix for CVE-2005-4558.
- How severe is CVE-2006-0818?
- CVE-2006-0818 has a CVSS 2.0 base score of 4.0, rated medium severity.
- Is CVE-2006-0818 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (79th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2006-0818?
- CVE-2006-0818 primarily affects Deerfield Visnetic Mail Server. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2006-0818?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2006-0818 published?
- CVE-2006-0818 was published on 2006-07-21 and last updated on 2026-06-16.
References
- http://secunia.com/advisories/18953
- http://secunia.com/advisories/18966
- http://secunia.com/secunia_research/2006-12/advisory/
- http://secunia.com/secunia_research/2006-14/advisory/
- http://securitytracker.com/id?1016513
- http://securitytracker.com/id?1016514
- http://www.securityfocus.com/archive/1/440297/100/0/threaded
- http://www.securityfocus.com/archive/1/440302/100/0/threaded
- http://www.securityfocus.com/bid/19002
- http://www.securityfocus.com/bid/19007
- http://www.vupen.com/english/advisories/2006/2825
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27780
Affected products (3)
- cpe:2.3:a:deerfield:visnetic_mail_server:8.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:icewarp:web_mail:5.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:merak:mail_server:8.3.8r:*:windows:*:*:*:*:*
More vulnerabilities in Deerfield Visnetic Mail Server
- CVE-2005-4556 — High (CVSS 7.5): PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail…
- CVE-2005-4558 — Medium (CVSS 6.5): IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not…
- CVE-2006-0817 — Medium (CVSS 5.0): Absolute path directory traversal vulnerability in (a) MERAK Mail Server for Windows 8.3.8r with before IceWarp Web…
- CVE-2005-4557 — Medium (CVSS 5.0): dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0…
- CVE-2005-4559 — Medium (CVSS 5.0): mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0…