CVE-2006-4890: Multiple PHP remote file inclusion vulnerabilities in UNAK-CMS 1.5 and earlier allow remote attackers to ex...

Security readout for executives and security teams

UNAK-CMS 1.5 and earlier reportedly lets attackers make PHP include code from a remote URL through a dirroot parameter. If an old site is exposed, this can become server-side code execution. The bundle does not provide CVSS, a confirmed patch, or evidence of active exploitation. Exposure is likely limited to legacy UNAK-CMS 1.5 and earlier deployments, especially internet-facing PHP sites retaining the affected FCKeditor paths. The source bundle lists affected vendor/product metadata as n/a, so asset matching must rely on application inventory and file presence. Treat as a high-priority legacy exposure issue if UNAK-CMS exists in the environment. The risk is not broad modern ecosystem exposure, but a reachable old PHP CMS could allow full server compromise. Mitigation focus: Check vendor or archived project guidance for any fixed UNAK-CMS release.; Decommission or replace unsupported UNAK-CMS deployments where feasible.; Remove or restrict access to the affected FCKeditor PHP files..

Prepared

Jun 29, 2026, 10:19 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.