Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

TikiWiki allows attackers to upload and run malicious files

CVE-2005-0200 · published 21 years ago
Summary

Versions of TikiWiki older than 1.8.5 do not check files placed in the temporary upload folder. This lets a remote attacker place a PHP script on the server and have it run, potentially taking control of the web site. Upgrade to version 1.8.5 or later, or apply the vendor’s patch, and ensure file upload handling is properly restricted.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
tiki tikiwiki_cms\/groupware <= 1.6.1
cpe:2.3:a:tiki:tikiwiki_cms\/groupware:*:*:*:*:*:*:*:*
Original advisory text
TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vul...
TikiWiki before 1.8.5 does not properly validate files that have been uploaded to the temp directory, which could allow remote attackers to upload and execute arbitrary PHP scripts, a different vulnerability than CVE-2004-1386.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published2 May 2005
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2005-0200 · NVD
Track software like this
Free during beta