CVE-2006-6957: PHP remote file inclusion vulnerability in addons/mod_media/body.php in Docebo 3.0.3 and earlier, when regi...

Security readout for executives and security teams

This is an old Docebo vulnerability that can let an attacker run PHP code on the server if a vulnerable Docebo 3.0.3 or earlier install is exposed with register_globals enabled. Business risk is highest for legacy public training portals or forgotten deployments. Exposure appears limited to Docebo 3.0.3 and earlier where addons/mod_media/body.php is reachable and register_globals is enabled. The provided affected-product metadata is incomplete, so asset owners should validate by application version, file presence, and configuration rather than relying on CPE matching. Prioritize remediation if any legacy Docebo instance is internet-facing. Although this CVE is old and active exploitation is not evidenced here, successful abuse could mean full application-server compromise on affected configurations. Mitigation focus: Check Docebo or vendor guidance for a fixed release or supported migration path.; Disable register_globals on any legacy PHP stack that still enables it.; Restrict external access to affected Docebo paths until remediation is confirmed..

Prepared

Jun 29, 2026, 07:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.