UnratedFix available
mono — security advisory
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.
- Products
- mono
- Affected versions
- Not specified
- Fixed versions
- 1.2.2.1-1
- CVEs
- CVE-2006-6104
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:10 UTC · Revision 1
Source evidence
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.
osv:DEBIAN-CVE-2006-6104
mono
Fixed versions: 1.2.2.1-1
mono
Fixed versions: 1.2.2.1-1
mono
Fixed versions: 1.2.2.1-1
Complete source record
{
"id": "6e88478ba324522c4b770819960efb6df499185d0f1ad40d933f48abc7abf612",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-6104",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-6104",
"summary": "The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.",
"evidence": "osv:DEBIAN-CVE-2006-6104",
"products": [
{
"name": {
"value": "mono",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.2.1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mono",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.2.1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mono",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.2.1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-6104",
"aliases": [
"DEBIAN-CVE-2006-6104"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2.1-1"
}
]
}
],
"package": {
"name": "mono",
"purl": "pkg:deb/debian/mono?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-6104.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2.1-1"
}
]
}
],
"package": {
"name": "mono",
"purl": "pkg:deb/debian/mono?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-6104.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.2.1-1"
}
]
}
],
"package": {
"name": "mono",
"purl": "pkg:deb/debian/mono?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-6104.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-22T23:47:21.106878197Z",
"provider": "osv",
"upstream": [
"CVE-2006-6104"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-6104"
]
},
"related_cves": [
{
"value": "CVE-2006-6104",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410298,
"published_at": "2006-12-21T19:28:00+00:00"
}