Phpbb · Phpbb · CVE-2006-4758
**Name of the Vulnerable Software and Affected Versions**
phpBB version 2.0.21
**Description**
The issue arises from improper handling of pathnames ending in %00, allowing remote authenticated administrative users to upload arbitrary files. This can be achieved by sending a query to the "admin/admin board.php" endpoint with an `avatar path` parameter ending in `.php%00`.
**Recommendations**
For phpBB version 2.0.21, as a temporary workaround, consider restricting access to the `admin/admin board.php` endpoint to minimize the risk of exploitation. Avoid using the `avatar path` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.