High severity8.6OSV Advisory· Published Feb 3, 2018· Updated Jun 17, 2026

CVE-2017-18123

Description

The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dokuwiki/DokuwikiOSV2 versions
release-2005-07-01, release-2005-07-13, release-2005-09-19, …+ 1 more
- (no CPE)range: release-2005-07-01, release-2005-07-13, release-2005-09-19, …
- (no CPE)range: <=2017-02-19e
Splitbrain/DokuWikillm-fuzzy

Patches

Vulnerability mechanics

References

github.com/splitbrain/dokuwiki/commit/238b8e878ad48f370903465192b57c2072f65d86nvdPatch
github.com/splitbrain/dokuwiki/issues/2029nvdExploitIssue TrackingThird Party Advisory
vulnhive.com/2018/000004nvdExploitIssue TrackingPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2018/02/msg00004.htmlnvdIssue TrackingMailing ListThird Party Advisory
github.com/splitbrain/dokuwiki/pull/2019nvdIssue Tracking
hackerone.com/reports/238316nvdPermissions Required
lists.debian.org/debian-lts-announce/2018/07/msg00004.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000