CVE-2016-9646

Commit metadata forgery via CGI::FormBuilder context-dependent APIs

5.3 MediumFix available

CVE-2016-9646 is a medium vulnerability (CVSS 5.3) in Ikiwiki, published January 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in ikiwiki 3.20161229.

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the CGI->param API that led to Bugzilla's CVE-2014-1572), which can be abused to lead to commit metadata forgery.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

1.14%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.3

Record: CVE-2016-9646
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-287
Updated: 2026-11-02

CVE List No score

Commit metadata forgery via CGI::FormBuilder context-dependent APIs

Record: CVE-2016-9646
Updated: 2026-11-02

EUVDEUVD-2016-10447 No score

Record: EUVD-2016-10447
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fvvm-x83v-fc5r 5.3

ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field method (similar to the...

Record: GHSA-fvvm-x83v-fc5r
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSV 5.3

Record: CVE-2016-9646
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2016-9646 5.3

Record: DEBIAN-CVE-2016-9646
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-9646 5.3

Record: UBUNTU-CVE-2016-9646
CVSS 3.0: 5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVMGASA-2019-0113 No score

Updated ikiwiki packages fix security vulnerability

Several security issues identified in ikiwiki fixed by updating to version 3.20190228. See references for details

Record: MGASA-2019-0113
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10860-1 No score

ikiwiki-3.20200202.3-2.7 on GA media

These are all security issues fixed in the ikiwiki-3.20200202.3-2.7 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10860-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ikiwiki` Debian:12	before 3.20161229	3.20161229
`ikiwiki` Debian:13	before 3.20161229	3.20161229
`ikiwiki` Debian:14	before 3.20161229	3.20161229
`ikiwiki` Debian:7	before 3.20120629.2+deb7u2, plus listed versions 3.201206293.20120629.13.20120629.23.20120629.2+deb7u1	3.20120629.2+deb7u2
`ikiwiki` Debian:8	before 3.20141016.4, plus listed versions 3.20141016.23.20141016.3	3.20141016.4
`ikiwiki` Mageia:6	before 3.20190228-1.1.mga6	3.20190228-1.1.mga6
`ikiwiki` Ubuntu:16.04:LTS	All versions, plus listed versions 3.201506143.20160121	None known
`ikiwiki` openSUSE:Tumbleweed	before 3.20200202.3-2.7	3.20200202.3-2.7

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 24 moreShow less