Sign in
Deutsch English Español Polski
Medium

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated use

  • Disclosed: 03.01.2013
  • Updated: 11.10.2026 12:20

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) moin < 1.9.6 1.9.6

References

CVSS score 6.3/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F
Weakness (CWE)
CWE-434
Platform
Python (PyPI)
Package
moin
Disclosed
03.01.2013
Updated
11.10.2026 12:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-m2c4-jgmm-fvq3 - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2013-6 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: moin

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (41) in the archive
Total entries
41
First → latest
04.2008 05.2022
Without a fix
5
Exploited in attacks
0

Severity breakdown

  • High 11
  • Medium 30

Disclosures per year

earlier: 23

Severity:
  1. MoinMoin Improper Privilege Management
    High CVE-2004-1463 < 1.2.3 1.2.3
  2. MoinMoin Improper Access Control
    High CVE-2004-1462 < 1.2.3 1.2.3
  3. MoinMoin allows administrative access
    High CVE-2004-0708 < 1.2.2 1.2.2
  4. MoinMoin vulnerable to remote code execution via cache action
    High · 8.8 CVE-2020-25074 < 1.9.11 1.9.11
  5. Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated use this entry
    Medium · 6.3 CVE-2012-6081 < 1.9.6 1.9.6
  6. MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended ac
    High · 7.5 CVE-2009-4762 >= 1.7, < 1.7.3, >= 1.8, < 1.8.3 1.7.3, 1.8.3
  7. MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.
    High CVE-2010-0669 < 1.8.7, >= 1.9, < 1.9.2 1.8.7, 1.9.2
  8. The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.
    High CVE-2010-0717 < 1.8.7 1.8.7
  9. MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain se
    High · 7.5 CVE-2010-0667 >= 1.9, < 1.9.1 1.9.1
  10. MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability tha
    High · 7.5 CVE-2008-6603 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1
  11. MoinMoin Denial of Service vulnerability via password_checker function
    High · 7.5 CVE-2008-6549 < 1.6.1 1.6.1
  12. The user form processing (userform.py) in MoinMoin before 1.6.3, when using ACLs or a non-empty superusers list, does not properly manage users, which allows remote attackers to gain privileges.
    High · 7.5 CVE-2008-1937 < 1.6.3, >= 1.7, < 1.7.1 1.6.3, 1.7.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.