I got a report on a bug in ghostscript, which can be reached via imagemagick and thus lead to an RCE in DokuWiki. As far as I can see, there is a ghostscript fix committed, but not released yet.
If you use the im_convert setting (default installs don't), you should setup a imagemagick policy.xml that blocks the PS/EPS/PDF/XPS coders.
Our official Docker image is not affected - it does not install ghostscript.
DokuWiki
npub1fu…ddhhx
2026-09-20 08:06:13 UTC
Author Public Key
npub1fuqt7sj3u7tfrm9g7n5js7m848uj56hgs8q0uhe3vze2awsm03esrddhhxSeen on
wss://relay.momostr.pinkPublished at
2026-09-20 08:06:13 UTCEvent JSON
{
"id": "757a506bebf3df42d813bffabf494c57e5900ffae2d188e1b8d6f13153a12183",
"pubkey": "4f00bf4251e79691eca8f4e9287b67a9f92a6ae881c0fe5f3160b2aeba1b7c73",
"created_at": 1789891573,
"kind": 1,
"tags": [
[
"proxy",
"https://phpc.social/@dokuwiki/117302334192144206",
"web"
],
[
"proxy",
"https://phpc.social/users/dokuwiki/statuses/117302334192144206",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://phpc.social/users/dokuwiki/statuses/117302334192144206",
"pink.momostr"
],
[
"-"
]
],
"content": "I got a report on a bug in ghostscript, which can be reached via imagemagick and thus lead to an RCE in DokuWiki. As far as I can see, there is a ghostscript fix committed, but not released yet. \n\nIf you use the im_convert setting (default installs don't), you should setup a imagemagick policy.xml that blocks the PS/EPS/PDF/XPS coders.\n\nOur official Docker image is not affected - it does not install ghostscript.",
"sig": "2f8b910aa2725432f996a078cb0e06d03c6fb496ff5e42ff0b8b977f108d2cb878c9cc970aab7b06d92131eb7d52655038ee43c291e5dcaeaa810f3a631d8064"
}