CVE-2006-5767: PHP remote file inclusion vulnerability in includes/xhtml.php in Drake CMS 0.2.2 alpha rev.846 and earlier...

Security readout for executives and security teams

CVE-2006-5767 affects old Drake CMS releases. A vulnerable PHP file can be influenced through the d_root parameter to include remote PHP code, which could let an attacker run code on the web server. Public exploit documentation exists, but the supplied sources do not show confirmed active exploitation. Exposure is likely limited to legacy, internet-facing Drake CMS installations at version 0.2.2 alpha rev.846 or earlier. Modern environments are only affected if this abandoned or historic application remains deployed, archived online, or reachable through forgotten virtual hosts. Treat exposed instances as urgent legacy risk. The affected software is very old, and the vulnerability can lead to server-side code execution. The practical decision is usually removal, isolation, or migration rather than extended remediation work. Mitigation focus: Identify and remove any public Drake CMS 0.2.2 alpha rev.846 or earlier deployments.; Check vendor or project guidance before assuming a specific patch exists.; If removal is delayed, restrict public access to affected Drake CMS paths..

Prepared

Jun 29, 2026, 09:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.