Description
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ikiwiki | 3.20110328 | — |
| Debian 13 | ikiwiki | 3.20110328 | — |
| Debian 12 | ikiwiki | 3.20110328 | — |
| Debian 6.0 | ikiwiki | 3.20100815.7 | DSA-2214-1 |
| Debian 5.0 | ikiwiki | 2.53.6 | DSA-2214-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ikiwiki | 3.20200202.3-2.7 | openSUSE-SU-2024:10860-1 |
Advisories 2
- DSA-2214-1 ikiwiki - missing input validation Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10860-1 ikiwiki-3.20200202.3-2.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- DSA-2214 vendor-advisory
- ADV-2011-1005 vdb-entry
- ADV-2011-0907 vdb-entry
- 44137 third-party-advisory
- http://ikiwiki.info/security/#index39h2
- 44079 third-party-advisory
- 47285 vdb-entry
- FEDORA-2011-5249 vendor-advisory