[pmwiki-announce] Quick fix for Windows-specific vulnerability before PmWiki 2.7.5

[Petko Yotov]

This is a quick update to provide a manual fix for a recently reported 
vulnerability.

PmWiki 2.7.5 closed a vulnerability in PmWikis on Windows servers, 
reported by Michael Engelke. It potentially allows a person with edit 
access to a page, to retrieve the full source text of another page in a 
read-protected group where the person should not have access. All wikis 
versions 2.0.0 to 2.7.4 on Windows servers may be vulnerable.

If your PmWiki installation:
* runs on a Windows server, and
* your wiki allows editing for untrusted users, even only WikiSandbox, 
and
* you may have sensitive information in restricted wikigroups, such as 
SiteAdmin.Notify, and
* you cannot immediately upgrade to 2.7.5,

If your wiki meets all the conditions above, to close the vulnerability 
before you've had the chance to upgrade, you can add this to 
farmconfig.php or config.php:

if(!empty($_REQUEST['template']))
   $_REQUEST['template'] = preg_replace('![./\\\\]+!', '.', 
$_REQUEST['template']);

Petko

-- 
If you upgrade :  https://www.pmwiki.org/Upgrades

On 05/08/2026 21:54, Petko Yotov wrote:
> Hello. PmWiki version 2.7.5 was published today, and is available at:
> 
>   https://www.pmwiki.org/pub/pmwiki/pmwiki-2.7.5.tgz
>   https://www.pmwiki.org/pub/pmwiki/pmwiki-2.7.5.zip
>     svn://www.pmwiki.org/pmwiki/tags/latest
> 
> This version closes a vulnerability in PmWikis on Windows servers, 
> reported by Michael Engelke. It potentially allows a person with 
> ''edit'' access to a page, to retrieve the full source text of another 
> page in a read-protected group where the person should not have access.
> 
> All wikis versions 2.0.0 to 2.7.4 on Windows servers may be vulnerable.
> 
> Additionally, this version includes updates for recent PHP versions, 
> and the documentation was updated.
> 
> Thanks,
> Petko