CVE Intelligence
Analysis AI-assisted

CVE-2025-51958: Aelsantex Runcommand DokuWiki Plugin OS Command Injection

CVE-2025-51958 is a critical OS command injection weakness (CWE-78) in the Aelsantex Runcommand plugin, version 2014-04-01, for DokuWiki. According to the record, unauthenticated attackers can execute arbitrary system commands, and the CNA scored it 9.8 under CVSS 3.1. No fixed version and no confirmed exploitation appear in the sources consulted, so defenders should first identify exposed installations.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-51958 describes an OS command injection weakness (CWE-78) in the Aelsantex Runcommand plugin, version 2014-04-01, for DokuWiki. The record states that unauthenticated attackers can run arbitrary system commands through the lib/plugins/runcommand/postaction.php component. The project repository is listed at GitHub.

Impact

  • The CVSS 3.1 base score recorded by the CNA is 9.8 (critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network exploitation without privileges or user interaction.
  • The vector rates confidentiality, integrity and availability impacts as high.
  • Arbitrary command execution would typically give an attacker control over the server context running the wiki. This is an inference from the vector and CWE, not a stated outcome in the record.

Affected products and versions

  • Product: Aelsantex Runcommand, a DokuWiki plugin.
  • Version listed: 2014-04-01.
  • The record lists no other affected versions and no fixed version. The absence of a fix in the record does not confirm that no fix exists.

Exploitation status

  • The record shows the product is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • The record contains no EPSS or SSVC data.

Remediation and mitigation

  • Identify every DokuWiki installation that includes the runcommand plugin, especially version 2014-04-01.
  • Because no fixed version is recorded, consider disabling or removing the plugin until the maintainer or vendor publishes clear guidance, and check the project pages for updates.
  • Restrict network access to the wiki and its plugin endpoints where practical, and do not rely only on the affected plugin for access control.
  • If you maintain the plugin, review the affected component and follow the project's advisories.

Detection guidance

  • Review web server logs for unexpected requests to the runcommand plugin path, particularly from unfamiliar sources.
  • Monitor the wiki host for unexpected child processes started by the web server account and for new or modified files.
  • Alert on outbound connections from the wiki server that have not occurred before.

Limitations of the available information

  • The record provides no exploitation timeline and no vendor-confirmed fix.
  • Affected versions other than 2014-04-01 are unknown.
  • The third-party gist referenced in the record was not independently verified for this analysis.

Frequently asked questions

What is the core risk of CVE-2025-51958?

The record describes OS command injection that lets unauthenticated attackers run arbitrary system commands on hosts running the affected plugin. The CNA scored it 9.8 critical under CVSS 3.1.

Is there a fixed version or confirmed exploitation?

The record lists no fixed version, and no confirmed exploitation appears in the sources consulted. It is not listed in the CISA KEV catalog in the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.