-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 25 Sep 2026 11:42:10 +0200
Source: dokuwiki
Architecture: source
Version: 2026-07-14.c+dfsg-1
Distribution: sid
Urgency: high
Maintainer: Daniel Baumann <daniel@debian.org>
Changed-By: Daniel Baumann <daniel@debian.org>
Changes:
dokuwiki (2026-07-14.c+dfsg-1) sid; urgency=high
.
* Merging upstream version 2026-07-14.c+dfsg:
- Security Fix for disableactions bypass (GH: #4731)
Attackers or users could circumvent restricted actions configured under
the $conf["disableactions"] setting. By prepending or appending
underscores (e.g., _action_) to a restricted action name, the sanitization
check could be bypassed, allowing forbidden features to execute.
Administrative or restricted features meant to be completely disabled
could be unexpectedly accessed by unauthorized users.
.
- Critical security fix (GH: #4752)
An object injection bug triggered during the processing of serialized
metadata/drafts allows an attacker to achieve Remote Code Execution (RCE)
or delete arbitrary files. An attacker must have an account with write
access to the wiki (e.g. standard editor privileges or open registration).
Almost every DokuWiki version released over the last decade is affected.
Checksums-Sha1:
87c64b645899174fae1d8844f78232c97a8b67c1 1386 dokuwiki_2026-07-14.c+dfsg-1.dsc
72743f511ce4bb050adf52023057b10d2aaf1557 1815808 dokuwiki_2026-07-14.c+dfsg.orig.tar.xz
e2df6494256359f1287b1eae0d3dae6e6beea74e 97324 dokuwiki_2026-07-14.c+dfsg-1.debian.tar.xz
bcf4d9f0e9a577b188273633f1ef80cb63c4e00f 5983 dokuwiki_2026-07-14.c+dfsg-1_amd64.buildinfo
Checksums-Sha256:
243a37c13e59f70191c904f9d3a4d35c48404f2498037d374c01d52fb5f4fc67 1386 dokuwiki_2026-07-14.c+dfsg-1.dsc
4a7e4c8b5d75f07b83dcdfcac14e6a760ceab1c42dadda81e40db18852791707 1815808 dokuwiki_2026-07-14.c+dfsg.orig.tar.xz
a7b982461841aecbdce733eec92e17d27e04a80ebdefba3044592a69b4518c8c 97324 dokuwiki_2026-07-14.c+dfsg-1.debian.tar.xz
3b643d73b0d362fd75db9451fa6c42e1a134b730dacf30663ec9b532525371ff 5983 dokuwiki_2026-07-14.c+dfsg-1_amd64.buildinfo
Files:
d5a63154a9217a0d13873196e6f240de 1386 web optional dokuwiki_2026-07-14.c+dfsg-1.dsc
d3007f8f2f16fc063299fa0c8f1ecb35 1815808 web optional dokuwiki_2026-07-14.c+dfsg.orig.tar.xz
6d2f3a2f4121825efe88ef80814125a8 97324 web optional dokuwiki_2026-07-14.c+dfsg-1.debian.tar.xz
ae7efad41a87c0ac280dd741eabec245 5983 web optional dokuwiki_2026-07-14.c+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iHUEARYKAB0WIQQmmGg4gLaoSj0ERgL7tPDoCoAiLwUCarZbbwAKCRD7tPDoCoAi
L7kXAP9jI5AhJNPCEqZK3BqE//YLDwsEjRKwIvl5gl26lVi+tAEA1VsDVUn4WDOp
14x9viGjGmC/0bJMTKjqSc9IH3EEVgg=
=ScD4
-----END PGP SIGNATURE-----
