CVE-2007-2836

Name	CVE-2007-2836
Description	Directory traversal vulnerability in session.rb in Hiki 0.8.0 through 0.8.6 allows remote attackers to delete arbitrary files via directory traversal sequences in the session ID, which is matched against an insufficiently restrictive regular expression before it is used to construct a filename that is marked for deletion at logout.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1324-1
Debian Bugs	430691

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
hiki (PTS)	buster	1.0.0-2	fixed
	bookworm, bullseye, sid, trixie	1.0.0-2.1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
hiki	source	sarge	(not affected)
hiki	source	etch	0.8.6-1etch1		DSA-1324-1
hiki	source	(unstable)	0.8.7-1	medium		430691

[sarge] - hiki <not-affected> (Vulnerable code not present)