Headline
CVE-2023-24612: Fix command injection (!6) · Merge requests · Organic Design / PdfBook · GitLab
The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
Skip to content
GitLab
- GitLab: the DevOps platform
- Explore GitLab
- Install GitLab
- How GitLab compares
- Get started
- GitLab docs
- GitLab Learn
Pricing
Talk to an expert
/
Help
Help
Support
Community forum
Submit feedback
Contribute to GitLab
Switch to GitLab Next
Projects Groups Snippets
Sign up now
Login
Sign in / Register
- Organic Design
- PdfBook
- Merge requests
- !6
Fix command injection
- Review changes
Download
Email patches
Plain diff
Merged Thomas Gerbet requested to merge tgerbet-enalean/PdfBook:command-injection into master Jan 24, 2023
- Overview 3
- Commits 1
- Pipelines 0
- Changes 1
The HtmlDocPath and Options options can now only be set via the global MediaWiki configuration.
Other options are now given to escapeshellarg() before being injected in the built command that will be executed via shell_exec().