CVE-2008-5186: The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusio...

Description

The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path

Metrics

EPSS Probability

1.97%

77.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions
Geshi	Geshi	<= 1.0.8
Geshi	Geshi	1.0.0
Geshi	Geshi	1.0.1
Geshi	Geshi	1.0.2
Geshi	Geshi	1.0.2_beta_1
Geshi	Geshi	1.0.3
Geshi	Geshi	1.0.4
Geshi	Geshi	1.0.5
Geshi	Geshi	1.0.6
Geshi	Geshi	1.0.7
Geshi	Geshi	1.0.7.1
Geshi	Geshi	1.0.7.2
Geshi	Geshi	1.0.7.3
Geshi	Geshi	1.0.7.4
Geshi	Geshi	1.0.7.5
Geshi	Geshi	1.0.7.6
Geshi	Geshi	1.0.7.7
Geshi	Geshi	1.0.7.8
Geshi	Geshi	1.0.7.9
Geshi	Geshi	1.0.7.10
Geshi	Geshi	1.0.7.11
Geshi	Geshi	1.0.7.12
Geshi	Geshi	1.0.7.13
Geshi	Geshi	1.0.7.14
Geshi	Geshi	1.0.7.15
Geshi	Geshi	1.0.7.16
Geshi	Geshi	1.0.7.17
Geshi	Geshi	1.0.7.18
Geshi	Geshi	1.0.7.19
Geshi	Geshi	1.0.7.20
Geshi	Geshi	1.0.7.21
Geshi	Geshi	1.0.7.22

References

Timeline

Published: Nov 21, 2008
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2008-5186?

The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path

How severe is CVE-2008-5186?

Severity scoring for CVE-2008-5186 is pending analysis. The EPSS model estimates a 1.97% probability of exploitation in the next 30 days.

How do I fix CVE-2008-5186?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.