CVE-2006-5289: Multiple PHP remote file inclusion vulnerabilities in Vtiger CRM 4.2 and earlier allow remote attackers to...

Security readout for executives and security teams

CVE-2006-5289 affects Vtiger CRM 4.2 and earlier. Certain Calendar PHP files accept a user-supplied URL through the calpath parameter, which can let a remote attacker make the server run attacker-controlled PHP code. This is a serious legacy exposure if any affected Vtiger instance is still reachable. Exposure is most likely in old, internet-facing Vtiger CRM deployments running version 4.2 or earlier. The provided structured affected-product data is incomplete, but the CVE description names Vtiger CRM 4.2 and earlier directly. Prioritize immediately if any Vtiger CRM 4.2 or earlier instance is internet-facing. The business risk is full server-side code execution on a legacy CRM, which could expose customer data and internal workflows. Mitigation focus: Inventory all Vtiger CRM deployments and identify versions 4.2 or earlier.; Check vendor or project guidance for fixed versions and supported upgrade paths.; Remove or retire legacy Vtiger instances that are no longer required..

Prepared

Jun 29, 2026, 10:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.