Sign in
Deutsch English Español Polski
Medium

MoinMoin Directory traversal vulnerability

  • Disclosed: 01.05.2022
  • Updated: 11.10.2026 13:17

Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the MOIN_ID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter. The issue has been fixed on e69a16b6e630.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) moin <= 1.5.8 no fix

References

CVSS score -
Weakness (CWE)
CWE-22
Platform
Python (PyPI)
Package
moin
Disclosed
01.05.2022
Updated
11.10.2026 13:17

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2026-668 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-6766-r2rx-mfw9 - CC BY 4.0

Vulnerability history: moin

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (41) in the archive
Total entries
41
First → latest
04.2008 05.2022
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • High 11
  • Medium 30

Disclosures per year

earlier: 23

Severity:
  1. MoinMoin Directory traversal vulnerability this entry
    Medium CVE-2008-0782 <= 1.5.8 no fix
  2. MoinMoin Improper Privilege Management
    High CVE-2004-1463 < 1.2.3 1.2.3
  3. MoinMoin Improper Access Control
    High CVE-2004-1462 < 1.2.3 1.2.3
  4. MoinMoin allows administrative access
    High CVE-2004-0708 < 1.2.2 1.2.2
  5. MoinMoin vulnerable to remote code execution via cache action
    High · 8.8 CVE-2020-25074 < 1.9.11 1.9.11
  6. MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended ac
    High · 7.5 CVE-2009-4762 >= 1.7, < 1.7.3, >= 1.8, < 1.8.3 1.7.3, 1.8.3
  7. MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.
    High CVE-2010-0669 < 1.8.7, >= 1.9, < 1.9.2 1.8.7, 1.9.2
  8. The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.
    High CVE-2010-0717 < 1.8.7 1.8.7
  9. MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain se
    High · 7.5 CVE-2010-0667 >= 1.9, < 1.9.1 1.9.1
  10. MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability tha
    High · 7.5 CVE-2008-6603 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1
  11. MoinMoin Denial of Service vulnerability via password_checker function
    High · 7.5 CVE-2008-6549 < 1.6.1 1.6.1
  12. The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
    High · 7.5 CVE-2008-1937 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.