CVE-2006-2878: Andreas Gohr Dokuwiki

High severity, CVSS 7.5. EPSS: 13.9% chance of exploitation in the next 30 days.

The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.

Affected products

• Andreas Gohr Dokuwiki: up to and including release_2006-06-04; version release_2004-07-04 only; version release_2004-07-07 only; version release_2004-07-12 only; version release_2004-07-21 only; version release_2004-07-25 only; …

Published 2006-06-07. Last modified 2026-06-16.