1# Security Policy 2 3We take the security of DokuWiki seriously and appreciate reports that help us keep it safe. This document describes what we do and do not consider a security vulnerability and how to get one fixed. 4 5## Reporting a vulnerability 6 7If you believe you have found a vulnerability, get in touch through any of these channels: 8 9* Send an e-mail to [Andi](mailto:andi@splitbrain.org) 10* Open a [GitHub Issue](https://github.com/dokuwiki/dokuwiki/issues) 11* Send a mail to the [Mailing List](https://www.dokuwiki.org/mailinglist) 12 13A useful report describes how to reproduce the problem and explains the impact. Suggestions for a fix are welcome, but not required. 14 15Please refer to our [AI policy](AI_POLICY.md) for general guidance on using AI tools. Most importantly, use your own voice and understanding to describe the issue and its impact. We expect you to manually verify any output generated by AI tools and to take responsibility for the content of your report. 16 17## Supported versions 18 19We only accept reports for the current stable release (branch `stable`) and for the `master` branch. Older versions are not supported, and any vulnerabilities in them will not be fixed. 20 21## Reaction & mitigation times 22 23All work is done by volunteers in their spare time. We aim to acknowledge your report quickly, usually within 48 hours. We will keep you updated about the availability of a fix. Fixes are usually available within a few days, but may take longer if the issue is complex or if we are waiting for a response from you. 24 25Depending on the severity, we will either release a hotfix for the current stable release or fold the fix into the next regular release. 26 27## Non-qualifying vulnerabilities 28 29Not every undesirable behavior is a security vulnerability, and treating one as such tends to create noise rather than make anyone safer. The following are out of scope for this policy: 30 31* **Performance problems and Denial of Service.**\ 32 Runaway regexes, `max_execution_time` timeouts, memory exhaustion and DoS in general are bugs, not vulnerabilities - report them as regular [bugs](https://github.com/dokuwiki/dokuwiki/issues), ideally with a fix that does not break legitimate use. 33 Example: [#4613](https://github.com/dokuwiki/dokuwiki/issues/4613). 34* **Behaviour of external software.**\ 35 How other software interprets DokuWiki's output is not our concern, as long as our output is standards-compliant. 36 Example: [#2450](https://github.com/dokuwiki/dokuwiki/issues/2450). 37* **Server-Side Request Forgery (SSRF).**\ 38 Access to intranet resources is a feature for many deployments. Isolating the wiki server from sensitive hosts is the responsibility of the network administrator. 39 Example: [#1708](https://github.com/dokuwiki/dokuwiki/issues/1708). 40* **Misconfiguration of the installation.**\ 41 Problems that only arise from an insecure setup, such as serving the `data/` directory directly instead of through `fetch.php`, are configuration issues, not vulnerabilities. 42 Example: [#4267](https://github.com/dokuwiki/dokuwiki/issues/4267). 43* **Anything that requires administrator access.**\ 44 Administrators are fully trusted and can already run arbitrary code, so config-based XSS or installing a malicious extension is not a vulnerability. 45 Example: [#2926](https://github.com/dokuwiki/dokuwiki/issues/2926). 46* **Attacks that require physical or network access.**\ 47 Man-in-the-middle and similar attacks that presuppose control over the device or network are out of scope. 48* **Third party plugins and templates.**\ 49 Only DokuWiki and its bundled plugins are covered here. Issues in other extensions are to be reported to their respective contacts. 50 Example: [#4368](https://github.com/dokuwiki/dokuwiki/issues/4368). 51 52## Public disclosure, credits and bounties 53 54Privately reported vulnerabilities will be disclosed as GitHub issues once a fix is available. We will credit the reporter in the issue. If you wish to remain anonymous, please let us know. 55 56We do not assign CVEs - we have enough on our plates already and have no interest in the security theater that is the CVE system. 57 58We do not offer bounties for vulnerabilities. 59