CVE-2005-2877: TWiki history function command injection via rev parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated command execution with public exploit code and very high EPSS, though the product is old and the record lacks modern scoring detail.

What it is

The revision control (history) function in TWiki 02-Sep-2004 and earlier fails to sanitize shell metacharacters, allowing remote attackers to inject commands. Because the flaw is reachable over the network without authentication, it exposes wiki servers to arbitrary code execution.

Impact

An attacker can execute arbitrary commands with the privileges of the web server user, leading to full compromise of the TWiki host and any data it can reach.

Attack surface

Reached remotely over the network through the rev parameter to TWikiUsers; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.

Exploitation

No CISA KEV listing, but EPSS is 0.70903 (99.4th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade TWiki to a version later than 02-Sep-2004 that includes the vendor patch referenced in the TWiki security alert.
• If immediate upgrade is not possible, restrict network access to the TWiki history/TWikiUsers functionality to trusted users only.
• Run the web server process under a low-privilege account with no shell access to limit command execution impact.
• Review and harden any wrapper scripts that pass user-supplied parameters to the shell, avoiding shell invocation where possible.

Detection

• Monitor web server logs for requests to TWikiUsers with rev parameters containing shell metacharacters such as ;, |, `, $(), or &&.
• Alert on unexpected child processes spawned by the web server user (for example shell or command interpreters).
• Audit outbound network connections and file writes originating from the TWiki process for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.