7.5

CVE-2008-5186: geshi Improper Input Validation

CVSS: 7.5v2.0HighModified
AliasesDEBIAN-CVE-2008-5186
Published 21-11-2008Last modified 07-08-2024
Open JSON

Vulnerability summary

CVE-2008-5186 is a high (CVSS 7.5) Improper Input Validation vulnerability in geshi. EPSS estimates a 1.97% chance of exploitation in the next 30 days, higher than 80.1% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v2.0 (NVD)
EPSS score
1.97%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1
DTSA-179-1

Timeline

  1. 21-11-2008
    PublishedVulnerability first disclosed.
  2. 07-08-2024
    Last modifiedVulnerability information updated.

Description

The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

1.97%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

0.00 pp

From 1.97% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.97%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • dokuwiki< 0.0.20080505-3.1
  • geshi< 1.0.8.1-1
Geshi1 product
  • geshi≤ 1.0.8 | 1.0.0 | 1.0.1 | 1.0.2 | 1.0.2_beta_1 | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.6 | 1.0.7 | 1.0.7.1 | 1.0.7.2 | 1.0.7.3 | 1.0.7.4 | 1.0.7.5 | 1.0.7.6 | 1.0.7.7 | 1.0.7.8 | 1.0.7.9 | 1.0.7.10 | 1.0.7.11 | 1.0.7.12 | 1.0.7.13 | 1.0.7.14 | 1.0.7.15 | 1.0.7.16 | 1.0.7.17 | 1.0.7.18 | 1.0.7.19 | 1.0.7.20 | 1.0.7.21 | 1.0.7.22

2 vendors · 3 products

References

7 links