CVE-2007-2676: Open Translation Engine header.php remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw allows unauthenticated remote code execution, public exploit code is referenced, and EPSS is very high, though the product is an older, likely low-prevalence application.

What it is

Open Translation Engine (OTE) 0.7.8 contains a remote file inclusion flaw in skins/header.php, where the ote_home parameter is used without validation to include a remote file. An attacker can point that parameter at a malicious URL and cause the server to execute arbitrary PHP code.

Impact

Successful exploitation gives the attacker arbitrary PHP code execution in the context of the web server, which can lead to full compromise of the application and its data.

Attack surface

The flaw is reachable over the network through HTTP requests to skins/header.php with a crafted ote_home parameter; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

CISA KEV does not list this CVE, but EPSS is high (0.69951, 99.34th percentile) and a reference is tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade or patch Open Translation Engine to a version that fixes the ote_home inclusion issue; if no fixed version is available, remove or disable the affected skins/header.php code path.
• Disable allow_url_include and allow_url_fopen in PHP where possible to block remote file inclusion.
• Restrict outbound network access from the web server so it cannot fetch attacker-controlled remote files.
• Deploy a WAF rule to block requests to skins/header.php containing URL values in the ote_home parameter.

Detection

• Search web server logs for requests to skins/header.php with ote_home containing http://, https://, ftp:// or other URL schemes.
• Monitor for unexpected outbound HTTP connections from the web server to external hosts.
• Look for new or modified PHP files in the web root and for PHP processes spawning shell commands.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.