CVE catalog

CVE-2006-6678

netrik: CVE-2006-6678

[CVE catalog]

Severity
High
Published
Source
[NVD] · [CVE record]
EPSS
1.84% · Oct 25, 2026

The edit_textarea function in form-file.c in Netrik 1.15.4 and earlier does not properly verify temporary filenames when editing textarea fields, which allows attackers to execute arbitrary commands via shell metacharacters in the filename.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannetriksid1.16.1-4fixed
Debiannetrikforky1.16.1-4fixed
Debiannetriktrixie1.16.1-4fixed
Debiannetrikbookworm1.16.1-2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannetriksourcesid1.15.3-1.1mediumNot reported[404233]
Debiannetriksourceforky1.15.3-1.1mediumNot reported[404233]
Debiannetriksourcetrixie1.15.3-1.1mediumNot reported[404233]
Debiannetriksourcebookworm1.15.3-1.1mediumNot reported[404233]

[Debian bug #404233]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [netrik]Fixed

    Source package: [netrik]

    Details (2)

    • 1.16.1-2+b2 · amd64 · bookworm

      Fixed · Fixed: 1.15.3-1.1

      dsa · netrik · debian · bookworm; dsa · netrik · debian · 12

    • 1.16.1-2+b2 · arm64 · bookworm

      Fixed · Fixed: 1.15.3-1.1

      dsa · netrik · debian · bookworm; dsa · netrik · debian · 12

[Debian 13 (Trixie)]

  • [netrik]Fixed

    Source package: [netrik]

    Details (2)

    • 1.16.1-4 · amd64 · trixie

      Fixed · Fixed: 1.15.3-1.1

      dsa · netrik · debian · 13

    • 1.16.1-4+b2 · arm64 · trixie

      Fixed · Fixed: 1.15.3-1.1

      dsa · netrik · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]