CVE-2006-2878
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to...
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
Exploit likelihood
What each source reports
NVD Score used
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
- Record
CVE-2006-2878- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
- Record
CVE-2006-2878- Updated
- 2026-11-02
EUVDEUVD-2006-2875 No score
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
- Record
EUVD-2006-2875- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9h77-xrgv-4cw7 No score
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to...
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
- Record
GHSA-9h77-xrgv-4cw7- Updated
- 2026-11-02
OSV No score
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
- Record
CVE-2006-2878- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-2878 No score
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
- Record
DEBIAN-CVE-2006-2878- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-2878 is a high vulnerability (CVSS 7.5) in Andreas Gohr Dokuwiki, published June 7, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.9%, the 96th percentile. Fixed in dokuwiki 0.0.20060309-4.
References
bugs.splitbrain.org/index.php?do=details&id=823
securityfocus.com/bid/18289
securitytracker.com/id?1016221
osvdb.org/25980
secunia.com/advisories/20429
Show 9 moreShow less
lists.grok.org.uk/pipermail/full-disclosure/2006-June/046602.html
vupen.com/english/advisories/2006/2142
hardened-php.net/advisory_042006.119.html
exchange.xforce.ibmcloud.com/vulnerabilities/26913
gentoo.org/security/en/glsa/glsa-200606-16.xml
nvd.nist.gov/vuln/detail/CVE-2006-2878
github.com/advisories/GHSA-9h77-xrgv-4cw7
security-tracker.debian.org/tracker/CVE-2006-2878