Description
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dokuwiki | 0.0.20060309-5.2 | — |
| Debian 13 | dokuwiki | 0.0.20060309-5.2 | — |
| Debian 12 | dokuwiki | 0.0.20060309-5.2 | — |
References
- http://bugs.splitbrain.org/?do=details&id=926
- ADV-2006-3851 vdb-entry
- GLSA-200609-20 vendor-advisory
- 22192 third-party-advisory
- 22199 third-party-advisory