CVE-2008-5186
** DISPUTED ** The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi)...
The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path
Exploit likelihood
What each source reports
NVD Score used
The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path
- Record
CVE-2008-5186- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path
- Record
CVE-2008-5186- Updated
- 2026-11-02
EUVDEUVD-2008-5164 No score
The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path
- Record
EUVD-2008-5164- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rhpx-cf93-fp5q No score
** DISPUTED ** The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi)...
** DISPUTED ** The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path.
- Record
GHSA-rhpx-cf93-fp5q- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path
- Record
CVE-2008-5186- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-5186 No score
The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path
- Record
DEBIAN-CVE-2008-5186- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dokuwikiDebian:12 |
before 0.0.20080505-3.1 | 0.0.20080505-3.1 |
dokuwikiDebian:13 |
before 0.0.20080505-3.1 | 0.0.20080505-3.1 |
dokuwikiDebian:14 |
before 0.0.20080505-3.1 | 0.0.20080505-3.1 |
geshiDebian:12 |
before 1.0.8.1-1 | 1.0.8.1-1 |
geshiDebian:13 |
before 1.0.8.1-1 | 1.0.8.1-1 |
geshiDebian:14 |
before 1.0.8.1-1 | 1.0.8.1-1 |
geshiDebian:5.0 |
before 1.0.7.22-1+lenny1 | 1.0.7.22-1+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5186 is a high vulnerability (CVSS 7.5) in Geshi, published November 21, 2008. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.97%, the 80th percentile. Fixed in dokuwiki 0.0.20080505-3.1.
References
exchange.xforce.ibmcloud.com/vulnerabilities/46271
sourceforge.net/project/shownotes.php?release_id=637321
secunia.com/advisories/32559
securityfocus.com/bid/32070
openwall.com/lists/oss-security/2008/11/10/8
osvdb.org/49488
nvd.nist.gov/vuln/detail/CVE-2008-5186
github.com/advisories/GHSA-rhpx-cf93-fp5q
security-tracker.debian.org/tracker/CVE-2008-5186