CVE-2017-18123

Name of the Vulnerable Software and Affected Versions: DokuWiki versions prior to 2017-02-19e

Description: The issue arises from the improper encoding of user input in the call parameter of the "/lib/exe/ajax.php" API endpoint. This leads to a reflected file download issue, allowing remote attackers to execute arbitrary programs.

Recommendations: For versions prior to 2017-02-19e, update to a version that properly encodes user input in the call parameter of the "/lib/exe/ajax.php" endpoint to prevent reflected file download attacks. As a temporary workaround, consider restricting access to the "/lib/exe/ajax.php" endpoint until a patch is available.