CVE-2006-6965: CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e, and possibly earlier, allows rem...

Security readout for executives and security teams

This issue affects legacy DokuWiki media fetching code. A remote attacker could manipulate a request parameter so the server adds unintended HTTP headers, enabling response splitting and potentially cross-site scripting. The sources do not provide CVSS, confirmed active exploitation, or a named fix. Exposure is most likely in internet-accessible, unsupported DokuWiki deployments at version 2006-03-09e or earlier. The source bundle lists affected vendor/product metadata as n/a, so asset teams should validate directly against deployed DokuWiki versions. Treat this as a legacy exposure cleanup item unless old DokuWiki is internet-facing. Prioritize discovery first, then upgrade or isolate affected instances. There is no source-backed evidence of active exploitation in the provided bundle. Mitigation focus: Inventory DokuWiki deployments and identify version 2006-03-09e or earlier.; Review DokuWiki, Gentoo, and distribution guidance for fixed package details.; Retire or isolate unsupported legacy DokuWiki instances until guidance is applied..

Prepared

Jun 29, 2026, 07:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.