CVE-2006-5759: index.php in Rhadrix If-CMS, possibly 1.01 and 2.07, allows remote attackers to obtain the full path of the...

Security readout for executives and security teams

This CVE describes an information leak in Rhadrix If-CMS where certain empty web request arguments can make the site reveal the server’s full filesystem path in an error message. That is not direct compromise, but it can help attackers understand the environment for later attacks. Exposure is likely limited to organizations still running legacy Rhadrix If-CMS, especially versions 1.01 or 2.07. Internet-facing deployments carry the most relevance because unauthenticated remote users are described as able to trigger the disclosure. Treat this as low operational urgency unless Rhadrix If-CMS is internet-facing or unsupported. The main business risk is environmental information leakage that may assist future attacks, not immediate system takeover based on the provided sources. Mitigation focus: Identify whether any public sites still run Rhadrix If-CMS.; Check vendor or archived advisory guidance for supported fixes.; Disable verbose PHP error display in production..

Prepared

Jun 29, 2026, 09:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.