CVE-2005-2997: Multiple directory traversal vulnerabilities in PHP Advanced Transfer Manager 1.30 allow remote attackers t...

Security readout for executives and security teams

This is an old PHP Advanced Transfer Manager 1.30 flaw that lets a remote user abuse directory traversal in specific page parameters to read files the web server can access. For organizations still hosting this legacy application, the business risk is exposure of sensitive server files, credentials, or application data. Exposure is likely limited to internet- or intranet-accessible deployments of PHP Advanced Transfer Manager 1.30. The affected product fields in the bundle are incomplete, so defenders should validate by software name, version, and reachable PHP routes rather than relying on CPE matching. Prioritize confirmation and containment if this software is still deployed. The vulnerability is old, but remotely readable server files can expose secrets and accelerate broader compromise. If no deployment exists, document the finding as not applicable. Mitigation focus: Inventory any PHP Advanced Transfer Manager deployments and confirm version 1.30 exposure.; Check current vendor or maintainer guidance before applying any assumed patch.; Remove or replace unsupported PHP Advanced Transfer Manager instances where practical..

Prepared

Jun 29, 2026, 17:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.