CVE-2016-9646: Commit metadata forgery via CGI::FormBuilder context-dependent APIs
Published Apr 13, 2018
·Updated
ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.
Affected Software
5 affected componentsFixes available
Ikiwiki ikiwiki<3.20161229
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
debian/ikiwiki
3.20200202.3-13.20250501-13.20260201-3
Event History
Apr 13, 2018
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionWeakness
Feb 19, 2026
Data Sourced
via Debian·07:12 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-9646?
CVE-2016-9646 is considered to be a medium severity vulnerability due to its potential for commit metadata forgery.
2
How do I fix CVE-2016-9646?
To remediate CVE-2016-9646, upgrade to ikiwiki version 3.20200202.3-1 or later.
3
What does CVE-2016-9646 affect?
CVE-2016-9646 affects versions of ikiwiki prior to 3.20161229 across various Debian releases.
4
What can be exploited in CVE-2016-9646?
CVE-2016-9646 can be exploited to forge commit metadata due to improper handling of input.
5
Is CVE-2016-9646 related to other vulnerabilities?
Yes, CVE-2016-9646 is similar in nature to Bugzilla's CVE-2014-1572, involving the CGI::FormBuilder->field method.