CVE-2017-7981

Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used within PhpWiki before 1.5.5 with a syntax value in its first argument, and an authenticated Tuleap user can control this value, even with shell metacharacters, as demonstrated by a '<?plugin SyntaxHighlighter syntax="c;id"' line to execute the id command.

• CWE-78

• https://github.com/xdrr/vulnerability-research/blob/master/webapp/tuleap/2017.04.tuleap-auth-ci.mdExploit, Third Party Advisory
• https://tuleap.net/file/shownotes.php?release_id=137#/linked-artifactsRelease Notes, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=10159Patch, Vendor Advisory
• https://www.exploit-db.com/exploits/41953/Third Party Advisory, VDB Entry
• https://github.com/xdrr/vulnerability-research/blob/master/webapp/tuleap/2017.04.tuleap-auth-ci.mdExploit, Third Party Advisory
• https://tuleap.net/file/shownotes.php?release_id=137#/linked-artifactsRelease Notes, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=10159Patch, Vendor Advisory
• https://www.exploit-db.com/exploits/41953/Third Party Advisory, VDB Entry

Published

Apr 29, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7975Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of…
• CVE-2017-7976Artifex jbig2dec 0.13 allows out-of-bounds writes and reads …
• CVE-2017-7977The Screensavercc component in eLux RP before 5.5.0 allows a…9.8
• CVE-2017-7978Samsung Android devices with L(5.0/5.1), M(6.0), and N(7.x) …
• CVE-2017-7979The cookie feature in the packet action API implementation i…
• CVE-2017-7980Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator …
• CVE-2017-7982Integer overflow in the plist_from_bin function in bplist.c …
• CVE-2017-7983In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), mail sent u…
• CVE-2017-7984In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate …
• CVE-2017-7985In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate …
• CVE-2017-7986In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0), inadequate …
• CVE-2017-7987In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0), inadequate …