CVE-2006-2698: Geeklog 1.4.0sr2 and earlier allows remote attackers to obtain the full installation path via a direct requ...

Security readout for executives and security teams

Geeklog 1.4.0sr2 and earlier may reveal the server’s full installation path when certain PHP files are accessed directly or with invalid input. This does not by itself grant access, but it can expose internal filesystem details that help attackers plan follow-on attacks. Exposure is most likely on legacy public Geeklog deployments at version 1.4.0sr2 or earlier, especially where PHP errors are displayed to users. Modernized or retired deployments are unlikely to be affected unless old files remain reachable. Treat this as low urgency unless legacy Geeklog remains internet-facing or handles sensitive operations. It is not known to be actively exploited, but old public CMS software should be upgraded, isolated, or retired as part of exposure reduction. Mitigation focus: Inventory public Geeklog instances and confirm whether versions are 1.4.0sr2 or earlier.; Check Geeklog vendor security guidance for the appropriate fixed release or workaround.; Disable public PHP error display and route errors to server-side logs..

Prepared

Jun 29, 2026, 12:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.