CVE-2007-4921: Ajax File Browser PHP remote file inclusion via approot parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with public exploit code and very high EPSS, though the product is an old beta and not in KEV.

What it is

Ajax File Browser 3 Beta contains a PHP remote file inclusion flaw in _includes/settings.inc.php. The approot parameter is used to include a remote file without validation, letting an attacker supply a URL to attacker-controlled PHP code. This matters because successful inclusion results in arbitrary PHP code execution on the server.

Impact

An attacker can execute arbitrary PHP code with the privileges of the web server, leading to full compromise of the application and potentially the host. No confidentiality, integrity or availability impact is excluded by the flaw itself.

Attack surface

Reachable over the network through HTTP requests to _includes/settings.inc.php with a crafted approot parameter. No authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Not listed in CISA KEV, but EPSS is 0.52766 (98.9th percentile) and a public Exploit-DB entry (4405) exists, indicating known public exploit code.

What to do

• Patch or upgrade Ajax File Browser to a version that does not use the approot parameter for remote includes; if no fixed version exists, remove or disable the affected component.
• Disable allow_url_include and allow_url_fopen in php.ini to block remote file inclusion at the PHP level.
• Restrict outbound network access from the web server so it cannot fetch attacker-controlled URLs.
• Validate and whitelist the approot parameter, or replace dynamic includes with a fixed local path.
• Deploy a WAF rule to block requests to _includes/settings.inc.php containing URL values in approot.

Detection

• Search web server and PHP logs for requests to _includes/settings.inc.php with approot containing http:// or https:// or other URL schemes.
• Monitor for outbound HTTP requests from the web server to external hosts shortly after requests to settings.inc.php.
• Look for unexpected PHP files or web shells written to the web root or upload directories.
• Alert on PHP include or require errors referencing remote URLs in error logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.