Read the docs
TI-2006-04525 Aliases CVE-2006-4679GHSA-v3v7-2m7q-j6jq

DokuWiki before 2006-03-09c enables the debug feature by default, which allows remote…

Priority LOW 26Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

DokuWiki before 2006-03-09c enables the debug feature by default, which allows remote attackers to obtain sensitive information by calling doku.php with the X-DOKUWIKI-DO HTTP header set to "debug".

Why it matters now

EPSS 0.01692 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:andreas_gohr:dokuwiki:*:*:*:*:*:*:*:*up to release_2006-03-09VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-04:*:*:*:*:*:*:*release_2004-07-04VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-07:*:*:*:*:*:*:*release_2004-07-07VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-12:*:*:*:*:*:*:*release_2004-07-12VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-21:*:*:*:*:*:*:*release_2004-07-21VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-25:*:*:*:*:*:*:*release_2004-07-25VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-08:*:*:*:*:*:*:*release_2004-08-08VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-15a:*:*:*:*:*:*:*release_2004-08-15aVulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-22:*:*:*:*:*:*:*release_2004-08-22VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-12:*:*:*:*:*:*:*release_2004-09-12VulnerableAndreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:*:*:*:*:*:*:*:* Versions up to release_2006-03-09 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-04:*:*:*:*:*:*:* Versions release_2004-07-04 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-07:*:*:*:*:*:*:* Versions release_2004-07-07 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-12:*:*:*:*:*:*:* Versions release_2004-07-12 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-21:*:*:*:*:*:*:* Versions release_2004-07-21 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-07-25:*:*:*:*:*:*:* Versions release_2004-07-25 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-08:*:*:*:*:*:*:* Versions release_2004-08-08 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-15a:*:*:*:*:*:*:* Versions release_2004-08-15a Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-08-22:*:*:*:*:*:*:* Versions release_2004-08-22 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-12:*:*:*:*:*:*:* Versions release_2004-09-12 Vulnerable ·Andreas Gohr
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-25:*:*:*:*:*:*:*release_2004-09-25VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-30:*:*:*:*:*:*:*release_2004-09-30VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-10-19:*:*:*:*:*:*:*release_2004-10-19VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-11-01:*:*:*:*:*:*:*release_2004-11-01VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-11-02:*:*:*:*:*:*:*release_2004-11-02VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-11-10:*:*:*:*:*:*:*release_2004-11-10VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-01-14:*:*:*:*:*:*:*release_2005-01-14VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-01-15:*:*:*:*:*:*:*release_2005-01-15VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-01-16a:*:*:*:*:*:*:*release_2005-01-16aVulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-02-06:*:*:*:*:*:*:*release_2005-02-06VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-02-18:*:*:*:*:*:*:*release_2005-02-18VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-05-07:*:*:*:*:*:*:*release_2005-05-07VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-07-01:*:*:*:*:*:*:*release_2005-07-01VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-07-13:*:*:*:*:*:*:*release_2005-07-13VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-09-19:*:*:*:*:*:*:*release_2005-09-19VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-09-22:*:*:*:*:*:*:*release_2005-09-22VulnerableAndreas Gohr
cpe:2.3:a:andreas_gohr:dokuwiki:release_2006-03-05:*:*:*:*:*:*:*release_2006-03-05VulnerableAndreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-25:*:*:*:*:*:*:* Versions release_2004-09-25 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-09-30:*:*:*:*:*:*:* Versions release_2004-09-30 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-10-19:*:*:*:*:*:*:* Versions release_2004-10-19 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-11-01:*:*:*:*:*:*:* Versions release_2004-11-01 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-11-02:*:*:*:*:*:*:* Versions release_2004-11-02 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2004-11-10:*:*:*:*:*:*:* Versions release_2004-11-10 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-01-14:*:*:*:*:*:*:* Versions release_2005-01-14 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-01-15:*:*:*:*:*:*:* Versions release_2005-01-15 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-01-16a:*:*:*:*:*:*:* Versions release_2005-01-16a Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-02-06:*:*:*:*:*:*:* Versions release_2005-02-06 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-02-18:*:*:*:*:*:*:* Versions release_2005-02-18 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-05-07:*:*:*:*:*:*:* Versions release_2005-05-07 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-07-01:*:*:*:*:*:*:* Versions release_2005-07-01 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-07-13:*:*:*:*:*:*:* Versions release_2005-07-13 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-09-19:*:*:*:*:*:*:* Versions release_2005-09-19 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2005-09-22:*:*:*:*:*:*:* Versions release_2005-09-22 Vulnerable ·Andreas Gohr
  • cpe:2.3:a:andreas_gohr:dokuwiki:release_2006-03-05:*:*:*:*:*:*:* Versions release_2006-03-05 Vulnerable ·Andreas Gohr

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-4679
  2. 2026-10-03 Alias added: GHSA-v3v7-2m7q-j6jq

References

Exploit 1

Advisory 2

  • TI-2006-02786 The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote… CVSS 2.0HIGH 7.5
  • TI-2004-02430 DokuWiki before 2004-10-19, when used on a web server that permits execution based on… CVSS 2.0HIGH 7.5
  • TI-2006-04915 lib/exec/fetch.php in DokuWiki before 2006-03-09e, when conf[imconvert] is configured to… CVSS 2.0HIGH 7.5
  • TI-2006-04521 Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before… CVSS 2.0HIGH 7.5
  • TI-2006-04520 Direct static code injection vulnerability in doku.php in DokuWiki before 2006-030-09c… CVSS 2.0HIGH 7.5
  • TI-2004-02429 DokuWiki before 2004-10-19 allows remote attackers to access administrative functionality… CVSS 2.0HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences