From 5ko at 5ko.fr  Wed Aug  5 12:54:13 2026
From: 5ko at 5ko.fr (Petko Yotov)
Date: Wed, 05 Aug 2026 21:54:13 +0200
Subject: [pmwiki-users] PmWiki 2.7.5 released
Message-ID: <8b2753db78dcbe519cee170d40a5d95b@5ko.fr>

Hello. PmWiki version 2.7.5 was published today, and is available at:

   https://www.pmwiki.org/pub/pmwiki/pmwiki-2.7.5.tgz
   https://www.pmwiki.org/pub/pmwiki/pmwiki-2.7.5.zip
     svn://www.pmwiki.org/pmwiki/tags/latest

This version closes a vulnerability in PmWikis on Windows servers, 
reported by Michael Engelke. It potentially allows a person with 
''edit'' access to a page, to retrieve the full source text of another 
page in a read-protected group where the person should not have access.

All wikis versions 2.0.0 to 2.7.4 on Windows servers may be vulnerable.

Additionally, this version includes updates for recent PHP versions, and 
the documentation was updated.

Thanks,
Petko

-- 
If you upgrade :  https://www.pmwiki.org/Upgrades


From 5ko at 5ko.fr  Fri Aug  7 00:56:57 2026
From: 5ko at 5ko.fr (Petko Yotov)
Date: Fri, 07 Aug 2026 09:56:57 +0200
Subject: [pmwiki-users] Quick fix for Windows-specific vulnerability before
 PmWiki 2.7.5
In-Reply-To: <8b2753db78dcbe519cee170d40a5d95b@5ko.fr>
References: <8b2753db78dcbe519cee170d40a5d95b@5ko.fr>
Message-ID: <ed9ab674663940cc2b538c2079cbece1@5ko.fr>

This is a quick update to provide a manual fix for a recently reported 
vulnerability.

PmWiki 2.7.5 closed a vulnerability in PmWikis on Windows servers, 
reported by Michael Engelke. It potentially allows a person with edit 
access to a page, to retrieve the full source text of another page in a 
read-protected group where the person should not have access. All wikis 
versions 2.0.0 to 2.7.4 on Windows servers may be vulnerable.

If your PmWiki installation:
* runs on a Windows server, and
* your wiki allows editing for untrusted users, even only WikiSandbox, 
and
* you may have sensitive information in restricted wikigroups, such as 
SiteAdmin.Notify, and
* you cannot immediately upgrade to 2.7.5,

If your wiki meets all the conditions above, to close the vulnerability 
before you've had the chance to upgrade, you can add this to 
farmconfig.php or config.php:

if(!empty($_REQUEST['template']))
   $_REQUEST['template'] = preg_replace('![./\\\\]+!', '.', 
$_REQUEST['template']);

Petko

-- 
If you upgrade :  https://www.pmwiki.org/Upgrades

On 05/08/2026 21:54, Petko Yotov wrote:
> Hello. PmWiki version 2.7.5 was published today, and is available at:
> 
>   https://www.pmwiki.org/pub/pmwiki/pmwiki-2.7.5.tgz
>   https://www.pmwiki.org/pub/pmwiki/pmwiki-2.7.5.zip
>     svn://www.pmwiki.org/pmwiki/tags/latest
> 
> This version closes a vulnerability in PmWikis on Windows servers, 
> reported by Michael Engelke. It potentially allows a person with 
> ''edit'' access to a page, to retrieve the full source text of another 
> page in a read-protected group where the person should not have access.
> 
> All wikis versions 2.0.0 to 2.7.4 on Windows servers may be vulnerable.
> 
> Additionally, this version includes updates for recent PHP versions, 
> and the documentation was updated.
> 
> Thanks,
> Petko


