CVE-2009-1960
NoneCVSS
—
EPSS
23.2%
Published
Jun 8, 2009
CISA due date
—
The record
inc/init.php in DokuWiki 2009-02-14, rc2009-02-06, and rc2009-01-30, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the config_cascade[main][default][] parameter to doku.php. NOTE: PHP remote file inclusion is also possible in PHP 5 using ftp:// URLs.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | dokuwiki | 0 | 0.0.20090214b-1 |
| Debian:11 | dokuwiki | 0 | 0.0.20090214b-1 |
| Debian:12 | dokuwiki | 0 | 0.0.20090214b-1 |
| Debian:13 | dokuwiki | 0 | 0.0.20090214b-1 |
| Ubuntu:14.04:LTS | dokuwiki | 0 | 0.0.20131208-1 |
| Ubuntu:16.04:LTS | dokuwiki | 0 | 0.0.20140929.d-1ubuntu1 |
Related vulnerabilities
- CVE-2010-0288 A typo in the administrator permission check in the ACL Manager plugin… Also affects dokuwiki
- CVE-2010-0287 Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in… Also affects dokuwiki
- CVE-2006-2878 The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote… Also affects dokuwiki
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94
- CVE-2026-112095 A flaw has been found in SourceCodester Inventory System 1.0. CWE-94
- CVE-2026-112042 A security flaw has been discovered in diem-project diem up to… CWE-94