CVE-2006-6417: PHP remote file inclusion vulnerability in inc/CONTROL/import/import-mt.php in b2evolution 1.8.5 through 1....

Security readout for executives and security teams

This is an old b2evolution issue where a public import script could be tricked into loading PHP code from an attacker-controlled URL. If an affected site is still reachable, compromise could mean server-side code execution. The provided sources do not show active exploitation or a confirmed fixed version. Exposure is most likely on legacy internet-facing b2evolution deployments running 1.8.5 through 1.9 beta with the import-mt.php path accessible. Modern systems are unlikely affected unless old application code remains deployed, restored from backup, or reachable under forgotten virtual hosts. Treat this as urgent only if legacy b2evolution is still deployed. The business risk is full server compromise from an internet-facing PHP application flaw, but scope is likely narrow and depends on finding old exposed installations. Mitigation focus: Inventory b2evolution instances and confirm whether versions 1.8.5 through 1.9 beta exist.; Check archived b2evolution or advisory guidance for a fixed release or supported workaround.; Remove or restrict public access to import-mt.php when the import function is not required..

Prepared

Jun 29, 2026, 08:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.