CVE-2006-2576: Multiple PHP remote file inclusion vulnerabilities in Docebo 3.0.3 and earlier, when register_globals is en...

Security readout for executives and security teams

CVE-2006-2576 affects legacy Docebo 3.0.3 and earlier systems when PHP register_globals is enabled. A remote attacker could make the application include attacker-controlled PHP code, leading to server-side code execution. Exposure is mainly a concern for old, internet-facing Docebo installations that were never upgraded or decommissioned. Likely exposure is narrow but serious: obsolete Docebo 3.0.3 or earlier deployments running PHP with register_globals enabled, especially public web servers. Modern systems are unlikely to be affected unless they still host old Docebo code or archives reachable by web requests. Prioritize this if legacy Docebo exists on public infrastructure. The business risk is full compromise of an outdated web application, but the scope should be limited to old deployments with risky PHP settings. If no such systems exist, document non-exposure and close. Mitigation focus: Inventory web servers for Docebo 3.0.3 or earlier code.; Disable PHP register_globals if still present in legacy PHP environments.; Remove or isolate obsolete Docebo deployments from internet access..

Prepared

Jun 29, 2026, 12:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.