CVE-2006-3934: Absolute path traversal vulnerability in downloadTrigger.jsp in Alkacon OpenCms before 6.2.2 allows remote...

Security readout for executives and security teams

CVE-2006-3934 is an authenticated file download flaw in Alkacon OpenCms before 6.2.2. A logged-in remote user could request an absolute file path through downloadTrigger.jsp and retrieve files the application server can read. Business risk depends on whether old OpenCms instances remain in use and who can authenticate. Exposure is most likely on legacy OpenCms deployments older than 6.2.2, especially internet-facing authoring or administration environments where non-admin users can authenticate. Modern systems are unlikely to be affected unless they still run or expose this old OpenCms code path. Prioritize quickly if any OpenCms before 6.2.2 remains reachable by users or the internet. The flaw is old and authenticated, but arbitrary file download can expose credentials and configuration. If no legacy OpenCms exists, record as not applicable. Mitigation focus: Inventory OpenCms instances and confirm whether any are older than 6.2.2.; Upgrade affected OpenCms deployments to 6.2.2 or later where still supported.; Restrict access to OpenCms authoring and administration interfaces to trusted networks and users..

Prepared

Jun 29, 2026, 11:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.