CVE-2025-51958: DokuWiki runcommand Plugin RCE Vulnerability

CVE-2025-51958 Overview

CVE-2025-51958 is a critical command injection vulnerability in the aelsantex runcommand plugin (version 2014-04-01) for DokuWiki. This vulnerability allows unauthenticated remote attackers to execute arbitrary system commands on the underlying server through the lib/plugins/runcommand/postaction.php endpoint. The lack of authentication combined with insufficient input validation creates a severe security risk for any DokuWiki installation running this plugin.

Critical Impact

Unauthenticated attackers can execute arbitrary system commands on vulnerable DokuWiki servers, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• aelsantex runcommand plugin version 2014-04-01 for DokuWiki
• DokuWiki installations with the runcommand plugin enabled
• All systems running vulnerable versions of the runcommand plugin

Discovery Timeline

• 2026-01-30 - CVE-2025-51958 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-51958

Vulnerability Analysis

This vulnerability is classified as OS Command Injection (CWE-78), which occurs when an application passes unsafe user-supplied data to a system shell. In the case of the DokuWiki runcommand plugin, the postaction.php script fails to properly sanitize user input before passing it to system command execution functions.

The critical flaw lies in the plugin's design, which exposes a publicly accessible PHP endpoint that processes user-controlled data without authentication checks. An attacker can craft malicious HTTP requests to the vulnerable endpoint, injecting shell metacharacters and arbitrary commands that are then executed with the privileges of the web server process.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without any prior authentication, making it particularly dangerous for internet-facing DokuWiki installations.

Root Cause

The root cause of this vulnerability stems from two fundamental security failures in the runcommand plugin:

1. Missing Authentication: The postaction.php endpoint does not verify user identity or session validity before processing requests, allowing anonymous access to dangerous functionality.

2. Insufficient Input Validation: User-supplied parameters are passed directly to system command execution without proper sanitization, escaping, or allowlist validation, enabling shell metacharacter injection.

Attack Vector

The attack is conducted over the network by sending specially crafted HTTP requests to the vulnerable lib/plugins/runcommand/postaction.php endpoint. An attacker can inject shell commands using common techniques such as command chaining operators (;, &&, ||), command substitution ($(...) or backticks), or pipe redirection.

A successful exploitation grants the attacker the ability to execute arbitrary commands with the privileges of the web server user (typically www-data or apache). This can lead to reverse shell establishment, sensitive file access, data exfiltration, malware installation, or pivoting to other systems on the network.

For technical details on the vulnerability, refer to the GitHub Gist containing analysis and the runcommand plugin repository.

Detection Methods for CVE-2025-51958

Indicators of Compromise

• Suspicious HTTP requests to /lib/plugins/runcommand/postaction.php with shell metacharacters in parameters
• Unexpected child processes spawned by the web server process (e.g., sh, bash, wget, curl, nc)
• Outbound network connections from the web server to unusual destinations
• Web server access logs showing repeated requests to the runcommand plugin endpoint
• Creation of unexpected files in web-accessible directories or /tmp

Detection Strategies

• Configure Web Application Firewall (WAF) rules to block requests containing shell metacharacters targeting the runcommand plugin path
• Implement file integrity monitoring on the DokuWiki installation directory to detect unauthorized modifications
• Monitor process execution on web servers for anomalous command execution patterns
• Review Apache/Nginx access logs for requests to postaction.php with suspicious query parameters or POST data

Monitoring Recommendations

• Enable detailed logging for all HTTP requests to the DokuWiki plugins directory
• Deploy endpoint detection and response (EDR) solutions to monitor web server process behavior
• Configure alerts for outbound connections from web server processes to non-standard ports
• Implement network traffic analysis to detect command and control communication patterns

How to Mitigate CVE-2025-51958

Immediate Actions Required

• Disable or remove the runcommand plugin from all DokuWiki installations immediately
• Audit DokuWiki servers for signs of compromise, including unauthorized files, processes, or network connections
• Review web server access logs for exploitation attempts targeting the vulnerable endpoint
• Isolate potentially compromised systems pending forensic analysis
• Reset credentials for any accounts accessible from the affected server

Patch Information

As of the last update, no official patch has been released for this vulnerability. The runcommand plugin (version 2014-04-01) appears to be unmaintained. Administrators should consider this plugin deprecated and seek alternative solutions for command execution functionality within DokuWiki.

For the latest information, refer to the official DokuWiki plugin page and the GitHub repository.

Workarounds

• Remove the runcommand plugin entirely from DokuWiki installations using rm -rf lib/plugins/runcommand/
• If removal is not immediately possible, block access to the plugin directory via web server configuration
• Implement network-level restrictions to limit access to the DokuWiki admin interface
• Deploy a Web Application Firewall with rules to block command injection patterns

# Apache configuration to block access to the vulnerable plugin
<Directory "/var/www/dokuwiki/lib/plugins/runcommand">
    Require all denied
</Directory>

# Nginx configuration alternative
location /lib/plugins/runcommand {
    deny all;
    return 404;
}