CVE-2024-33103

Name	CVE-2024-33103
Description	An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by uploading a crafted SVG file. NOTE: as noted in the 4267 issue reference, there is a position that exploitability can only occur with a misconfiguration of the product.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dokuwiki (PTS)	bullseye	0.0.20180422.a-2.1	vulnerable
	bookworm	0.0.20220731.a-2	vulnerable
	trixie	2024-02-06b+dfsg-9	vulnerable
	sid	2025-05-14.a+dfsg-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dokuwiki	source	(unstable)	(unfixed)	unimportant

Notes

https://github.com/dokuwiki/dokuwiki/issues/4267
Not a security issue by upstream response and rather a misconfiguration. The
data directory should never be directly accessible.