CVE-2007-2836 json
Directory traversal vulnerability in session.rb in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory…
published 2007-07-02 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-2828
- cvss
- 6.4
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.4%
- EPSS 2.4% chance of exploitation in 30 days, percentile 84%
- public exploits
- 0
- none known
Summary
Directory traversal vulnerability in session.rb in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory traversal sequences in the session ID, which is matched against an insufficiently restrictive regular expression before it is used to construct a filename that is marked for deletion at logout.
Patch / fix
- hiki Debian 12 0.8.7-1
debian advisories DEBIAN-CVE-2007-2836
- hikiwiki.org/hiki-0_8_6.patch patch
- secunia.com/advisories/25874 advisory
- secunia.com/advisories/25764 advisory
Exploit prediction
2.39% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:N/I:P/A:P |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
secunia.com
/advisories/25874
third-party-advisory, patch, vendor-advisory
-
secunia.com
/advisories/25764
third-party-advisory, patch, vendor-advisory
-
debian.org
/security/2007/dsa-1324
vendor-advisory
-
securityfocus.com
/bid/24603
vdb-entry
-
osvdb.org
/37469
vdb-entry
- hikiwiki.org /en/advisory20070624.html
-
vupen.com
/english/advisories/2007/2304
vdb-entry
- hikiwiki.org /hiki-0_8_6.patch
- bugs.debian.org /cgi-bin/bugreport.cgi?bug=430691
-
exchange.xforce.ibmcloud.com
/vulnerabilities/35029
vdb-entry
-
jvn.jp
/jp/JVN%2305187780/index.html
third-party-advisory
Sources
- CVE List CVE-2007-2836
- NVD CVE-2007-2836
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.