CVE-1999-0346: CGI PHP mlog script allows an attacker to read any file on the target server.

Security readout for executives and security teams

This is an old vulnerability in a CGI PHP "mlog" script that could let a remote attacker read files from the web server. The source bundle does not identify a vendor, supported product, versions, patch, or current exploit activity, so urgency depends on whether that legacy script is still deployed. Exposure is most plausible on legacy web servers that still host the CGI PHP mlog script. The bundle lists affected vendor, product, versions, and CPEs as n/a, so product-based scanning alone may miss or misclassify exposure. Handle as a targeted legacy exposure check, not a broad emergency. If the script is present on an internet-facing server, prioritize removal because arbitrary file read can expose credentials, configuration, and sensitive data. Mitigation focus: Inventory internet-facing and internal web roots for the mlog CGI PHP script.; Remove or disable the script if it is not explicitly required.; Restrict CGI execution and file-system read permissions for web server processes..

Prepared

Jul 12, 2026, 06:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.