CVE-2008-5186

The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks…

published November 21, 2008

CVSS
—
EPSS
2%
Percentile
80.1
In the wild
Unconfirmed
What it is

The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01971 · 80.1th percentile
Published
2008-11-21T02:00Z
EPSS history
Timeline
  • 21 NOV 02:00Z
    The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks…
    cvelistv5