| Package | Affected versions | Patched versions |
|---|---|---|
| geshi | = 1.0.0= 1.0.1= 1.0.2= 1.0.2_beta_1= 1.0.3= 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.7.1= 1.0.7.10= 1.0.7.11= 1.0.7.12= 1.0.7.13= 1.0.7.14= 1.0.7.15= 1.0.7.16= 1.0.7.17= 1.0.7.18= 1.0.7.19= 1.0.7.2= 1.0.7.20= 1.0.7.21= 1.0.7.22= 1.0.7.3= 1.0.7.4= 1.0.7.5= 1.0.7.6= 1.0.7.7= 1.0.7.8= 1.0.7.9≤ 1.0.8 |
The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free