CVE-2006-2878: High severity andreas gohr dokuwiki vulnerability
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by pregreplace with the /e (executable) modifier.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2878?
CVE-2006-2878 is considered a critical vulnerability as it allows remote attackers to execute arbitrary PHP code.
How do I fix CVE-2006-2878?
To fix CVE-2006-2878, upgrade DokuWiki to a version released after 2006-06-04, or patch the spellcheck.php file to remove the vulnerable regex handling.
What versions of DokuWiki are affected by CVE-2006-2878?
CVE-2006-2878 affects DokuWiki versions up to and including 2006-06-04 and several earlier versions.
What are the implications of CVE-2006-2878 on my DokuWiki installation?
Exploitation of CVE-2006-2878 could lead to unauthorized access and control over the server running DokuWiki.
Can I identify if my system is vulnerable to CVE-2006-2878?
You can identify if your system is vulnerable to CVE-2006-2878 by checking the DokuWiki version and examining the spellcheck.php code for the presence of the /e modifier in regex functions.