CVE-2007-6218: Multiple PHP remote file inclusion vulnerabilities in Ossigeno CMS 2.2 pre1 allow remote attackers to execu...

Security readout for executives and security teams

CVE-2007-6218 affects Ossigeno CMS 2.2 pre1. Several PHP files accept input that can point to remote code, allowing an attacker to execute arbitrary PHP if the vulnerable files are reachable. This is a legacy CMS issue, but exposed old installations should be treated as serious. Likely exposure is limited to organizations still running Ossigeno CMS 2.2 pre1 with the named upload/xax PHP paths reachable. The provided affected-product metadata is incomplete, listing vendor and product as n/a, so asset validation must rely on CMS name, version, and file paths. Prioritize if any internet-facing Ossigeno CMS instance remains in service. The business risk is potential server-side code execution on a legacy web application. If no Ossigeno CMS 2.2 pre1 assets exist, this can be closed after documented validation. Mitigation focus: Identify and retire or isolate any Ossigeno CMS 2.2 pre1 deployments.; Check vendor or maintainer guidance for an official fixed version or migration path.; Restrict internet access to the listed admin, module, patch, and catalogo PHP paths..

Prepared

Jun 28, 2026, 19:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.