CVE-2006-4692

The record

Argument injection vulnerability in the Windows Object Packager (packager.exe) in Microsoft Windows XP SP1 and SP2 and Server 2003 SP1 and earlier allows remote user-assisted attackers to execute arbitrary commands via a crafted file with a "/" (slash) character in the filename of the Command Line property, followed by a valid file extension, which causes the command before the slash to be executed, aka "Object Packager Dialogue Spoofing Vulnerability."

Affected packages

Related vulnerabilities

• CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-88
• CVE-2026-112900 Pillow is a Python imaging library. CWE-88
• CVE-2026-105326 An argument injection flaw was found in CUPS. CWE-88
• CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, enables… CWE-88
• CVE-2026-89066 Improper neutralization of special elements used in an OS command in the task synthesis… CWE-88
• CVE-2026-11765 Improper neutralization of argument delimiters in a command ('argument injection')… CWE-88
• CVE-2026-0304 A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables… CWE-88
• CVE-2026-8044 CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument… CWE-88