CVE-2006-4448: Multiple PHP remote file inclusion vulnerabilities in interact 2.2, when register_globals is enabled, allow...

Security readout for executives and security teams

CVE-2006-4448 is a legacy PHP remote file inclusion issue in Interact 2.2 when PHP register_globals is enabled. A remote attacker could make the application load attacker-controlled PHP, leading to arbitrary code execution. Business risk is highest for any still-internet-facing legacy Interact deployment. Exposure is likely limited to legacy Interact 2.2 deployments, especially public PHP installations with register_globals enabled. The provided affected-product metadata is incomplete, so teams should verify by application name, version, file paths, and PHP configuration rather than relying on CPE matching. Prioritize remediation if Interact 2.2 is still reachable from the internet. Although this is an old CVE with no KEV evidence in the bundle, the impact is remote code execution and public exploit material is referenced. Mitigation focus: Identify and retire or isolate any Interact 2.2 deployments.; Disable PHP register_globals where still present.; Restrict public access to affected legacy admin paths..

Prepared

Jun 29, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.