CVE-2008-5186

    Dashboard / Vulnerabilities / CVE-2008-5186

    CVE-2008-5186

    Published: 21 Nov 2008Last Modified: 10 Apr 2026

    Summary:

    Details: The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path

    References: http://secunia.com/advisories/32559, http://sourceforge.net/project/shownotes.php?release_id=637321, http://www.securityfocus.com/bid/32070, http://osvdb.org/49488, http://www.openwall.com/lists/oss-security/2008/11/10/8, https://exchange.xforce.ibmcloud.com/vulnerabilities/46271

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2008-5186 | CVE-DB