CVE-2006-5099
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use...
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.
Exploit likelihood
What each source reports
NVD Score used
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.
- Record
CVE-2006-5099- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.
- Record
CVE-2006-5099- Updated
- 2026-11-02
EUVDEUVD-2006-5084 No score
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.
- Record
EUVD-2006-5084- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5rj4-cvcv-vxcw No score
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use...
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.
- Record
GHSA-5rj4-cvcv-vxcw- Updated
- 2026-11-02
OSV No score
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.
- Record
CVE-2006-5099- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-5099 No score
lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to use ImageMagick, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) w and (2) h parameters, which are not filtered when invoking convert.
- Record
DEBIAN-CVE-2006-5099- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-5099 is a high vulnerability (CVSS 7.5) in Andreas Gohr Dokuwiki, published September 29, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.26%, the 83rd percentile. Fixed in dokuwiki 0.0.20060309-5.2.
References
bugs.splitbrain.org?do=details&id=926
vupen.com/english/advisories/2006/3851
security.gentoo.org/glsa/glsa-200609-20.xml
secunia.com/advisories/22192
nvd.nist.gov/vuln/detail/CVE-2006-5099
github.com/advisories/GHSA-5rj4-cvcv-vxcw
security-tracker.debian.org/tracker/CVE-2006-5099