CVE-2025-51958

CriticalRCE

Published: 30 January 2026

Published

30 January 2026

Modified

13 February 2026

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0014 33.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-51958 is a critical-severity OS Command Injection (CWE-78) vulnerability in Aelsantex Runcommand. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SA-22 (Unsupported System Components) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the command injection flaw in the runcommand plugin's postaction.php, preventing exploitation of CVE-2025-51958.

SI-10 Information Input Validation good match

prevent

Validates and sanitizes inputs to the postaction.php endpoint to block malicious OS command injection payloads.

SA-22 Unsupported System Components good match

prevent

Prohibits use of the unsupported 2014-04-01 runcommand plugin, eliminating exposure to this vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is an unauthenticated OS command injection in a public-facing DokuWiki web plugin, directly enabling T1190: Exploit Public-Facing Application for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postaction.php.

Deeper analysisAI

CVE-2025-51958 is a critical vulnerability in the aelsantex runcommand plugin version 2014-04-01 for DokuWiki, enabling unauthenticated attackers to execute arbitrary system commands. The flaw resides in the lib/plugins/runcommand/postaction.php file and is classified as CWE-78 (OS Command Injection). It received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for remote exploitation without privileges or user interaction.

Any unauthenticated attacker with network access to a vulnerable DokuWiki instance running this plugin can exploit the issue remotely. Exploitation involves sending crafted requests to the postaction.php endpoint, resulting in arbitrary command execution on the underlying server with the privileges of the web server process. This grants attackers high-impact control over confidentiality, integrity, and availability, potentially leading to full system compromise.

Advisories and related resources are available at https://gist.github.com/NtustLin/f64528002e4f61874045799127dc49a4, https://github.com/aelsantex/runcommand, and https://www.dokuwiki.org/plugin:runcommand, which provide further technical details on the plugin and vulnerability.