CVE-2013-1807: PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under...

Security readout for executives and security teams

PHP-Fusion versions before 7.02.06 may leave database backup files under the public web root using predictable names. An unauthenticated visitor might retrieve those backups if the directory is reachable, exposing sensitive site data. The record does not provide CVSS scoring, but the business impact can be high where backups contain user data or credentials. Exposure is likely limited to internet-facing PHP-Fusion deployments running versions earlier than 7.02.06 with database backups present under the public administration/db_backups/ path. The bundle does not identify affected CPEs, hosting defaults, or how commonly backups exist. Prioritize any public PHP-Fusion site below 7.02.06 because exposed database backups can create broad confidentiality impact. Urgency is highest for sites handling customer data, administrator credentials, or regulated records. Mitigation focus: Upgrade PHP-Fusion to 7.02.06 or later following vendor guidance.; Remove stale database backups from web-accessible directories.; Deny web access to administration backup directories..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.