CVE-2006-0658: Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as R...

Security readout for executives and security teams

This CVE describes an old FCKeditor file-upload weakness. Some applications embedded FCKeditor 2.0 or 2.2, including RunCMS, and could allow an attacker to upload a script that the server later runs. Business risk depends on whether legacy editor components are still reachable. Exposure is most likely in legacy PHP applications or CMS installations that bundled FCKeditor 2.0 or 2.2 and left the upload connector reachable. The source bundle names RunCMS as an example, but does not provide a complete affected-product list. Prioritize remediation where legacy public-facing PHP applications still expose FCKeditor upload functionality. This is old, but the impact can be severe because successful abuse may become remote code execution on the web server. Mitigation focus: Inventory applications for bundled FCKeditor 2.0 or 2.2 components.; Disable or restrict access to connector.php if the upload connector is unnecessary.; Check vendor or CMS guidance for supported upgrade or replacement paths..

Prepared

Jun 29, 2026, 14:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.