CVE-2024-33103
An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a...
An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by uploading a crafted SVG file. NOTE: as noted in the 4267 issue reference, there is a position that exploitability can only occur with a misconfiguration of the product.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by uploading a crafted SVG file. NOTE: as noted in the 4267 issue reference, there is a position that exploitability can only occur with a misconfiguration of the product.
- Record
CVE-2024-33103- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-30848
An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by uploading a crafted SVG file. NOTE: as noted in the 4267 issue reference, there is a position that exploitability can only occur with a misconfiguration of the product.
- Record
EUVD-2024-30848- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-57hj-hrjv-grpg
An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a...
An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code via uploading a crafted SVG file.
- Record
GHSA-57hj-hrjv-grpg- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by uploading a crafted SVG file. NOTE: as noted in the 4267 issue reference, there is a position that exploitability can only occur with a misconfiguration of the product.
- Record
CVE-2024-33103- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by uploading a crafted SVG file. NOTE: as noted in the 4267 issue reference, there is a position that exploitability can only occur with a misconfiguration of the product.
- Record
CVE-2024-33103- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-33103
An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by uploading a crafted SVG file. NOTE: as noted in the 4267 issue reference, there is a position that exploitability can only occur with a misconfiguration of the product.
- Record
DEBIAN-CVE-2024-33103- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dokuwikiDebian:12 |
All versions, plus listed versions 0.0.20220731.a-20.0.20220731.a-32024-02-06b+dfsg-0exp12024-02-06b+dfsg-0exp22024-02-06b+dfsg-1 Show 31 moreShow less2024-02-06b+dfsg-22024-02-06b+dfsg-32024-02-06b+dfsg-42024-02-06b+dfsg-52024-02-06b+dfsg-62024-02-06b+dfsg-72024-02-06b+dfsg-82024-02-06b+dfsg-92024-02-06b-0exp12024-02-06b-0exp22024-02-06b-0exp32024-02-06b-0exp42025-05-14+dfsg-12025-05-14.a+dfsg-12025-05-14.a+dfsg-22025-05-14.a+dfsg-32025-05-14.a+dfsg-42025-05-14.b+dfsg-12025-05-14.b+dfsg-22025-05-14.b+dfsg-32025-05-14.b+dfsg-42025-05-14.b+dfsg-52025-05-14.b+dfsg-62026-07-14+dfsg-12026-07-14.a+dfsg-12026-07-14.a+dfsg-22026-07-14.a+dfsg-32026-07-14.c+dfsg-12026-07-14.c+dfsg-22026-07-14.c+dfsg-32026-07-14a+dfsg-1 |
None known |
dokuwikiDebian:13 |
All versions, plus listed versions 2024-02-06b+dfsg-92025-05-14+dfsg-12025-05-14.a+dfsg-12025-05-14.a+dfsg-22025-05-14.a+dfsg-3 Show 15 moreShow less2025-05-14.a+dfsg-42025-05-14.b+dfsg-12025-05-14.b+dfsg-22025-05-14.b+dfsg-32025-05-14.b+dfsg-42025-05-14.b+dfsg-52025-05-14.b+dfsg-62026-07-14+dfsg-12026-07-14.a+dfsg-12026-07-14.a+dfsg-22026-07-14.a+dfsg-32026-07-14.c+dfsg-12026-07-14.c+dfsg-22026-07-14.c+dfsg-32026-07-14a+dfsg-1 |
None known |
dokuwikiDebian:14 |
All versions, plus listed versions 2024-02-06b+dfsg-92025-05-14+dfsg-12025-05-14.a+dfsg-12025-05-14.a+dfsg-22025-05-14.a+dfsg-3 Show 15 moreShow less2025-05-14.a+dfsg-42025-05-14.b+dfsg-12025-05-14.b+dfsg-22025-05-14.b+dfsg-32025-05-14.b+dfsg-42025-05-14.b+dfsg-52025-05-14.b+dfsg-62026-07-14+dfsg-12026-07-14.a+dfsg-12026-07-14.a+dfsg-22026-07-14.a+dfsg-32026-07-14.c+dfsg-12026-07-14.c+dfsg-22026-07-14.c+dfsg-32026-07-14a+dfsg-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-33103 is a medium vulnerability (CVSS 6.1) in Dokuwiki, published April 30, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile.