CVE-2007-5186: Segue CMS index.php themesdir parameter remote file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with public exploit code and very high EPSS, though the CVSS base score is only 6.8 and the product is legacy.

What it is

Segue CMS 1.8.4 and earlier allows remote file inclusion through the themesdir parameter in index.php, enabling arbitrary PHP code execution. The issue was initially disputed but the dispute was retracted after further analysis, so it is treated as valid. It matters because unauthenticated attackers can run code on the web server.

Impact

An attacker can execute arbitrary PHP code in the context of the web server, leading to full compromise of the application and potentially the host. This can expose data, allow persistence, and pivot into the underlying system.

Attack surface

Reached remotely over HTTP by supplying a crafted URL in the themesdir parameter to index.php; no authentication is required. The CVSS vector AV:N/AC:M/Au:N indicates network reachability with medium complexity and no authentication, and no user interaction is described.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.46824 (98.8th percentile) and a public Exploit-DB entry (4476) exists, indicating known public exploit code.

What to do

• Upgrade Segue CMS to a version later than 1.8.4 if available, or apply the vendor fix referenced in the SourceForge release notes.
• Disable or restrict remote file inclusion by setting allow_url_include=Off and allow_url_fopen=Off in PHP configuration.
• Validate and whitelist the themesdir parameter so it cannot contain URLs or path traversal sequences.
• Run the web application with least privilege and isolate it from sensitive internal services.
• If the product is no longer maintained, migrate to a supported CMS or remove the instance from exposure.

Detection

• Monitor web logs for requests to index.php with themesdir values containing http://, https://, ftp://, or remote hostnames.
• Alert on PHP errors or unexpected outbound HTTP requests originating from the web server process.
• Search for known exploit patterns or payloads associated with Exploit-DB 4476 in HTTP request bodies and query strings.
• Baseline and review file creation or modification events in web-accessible directories for signs of dropped PHP shells.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.