CVE-2006-5305: PHP remote file inclusion vulnerability in lat2cyr.php in the lat2cyr 1.0.1 and earlier phpbb module allows...

Security readout for executives and security teams

This is an old phpBB add-on issue that can let an internet attacker make the server load attacker-controlled PHP. If a vulnerable lat2cyr module is still present on a public site, compromise could mean full application-level code execution. The source bundle does not provide CVSS scoring or a named patch. Exposure is most likely on legacy phpBB deployments that installed the lat2cyr module, especially version 1.0.1 or earlier, and still expose lat2cyr.php to the web. Modern systems without this add-on are unlikely to be affected based on the provided sources. Treat this as a high-priority legacy exposure check for any remaining phpBB estate. The business urgency is highest for internet-facing sites because the vulnerability is associated with arbitrary PHP execution and public exploit references, even though active exploitation is not confirmed in the provided bundle. Mitigation focus: Inventory phpBB sites for the lat2cyr module and lat2cyr.php.; Remove or disable the module if it is no longer required.; Check vendor or community guidance for a fixed or replacement version..

Prepared

Jun 29, 2026, 09:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.