https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:41:09 +0000 https://cve.radiocsirt.org/vuln/cve-2020-25074 <p>The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.</p> <p>The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.</p> https://cve.radiocsirt.org/vuln/cve-2020-25074 https://cve.radiocsirt.org/vuln/ghsa-52q8-877j-gghq <p><strong>Affected:</strong> PyPI: moin</p> <p>### Impact The cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.</p> <p>### Patches Users are strongly advised to upgrade to a patched version.</p> <p>MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.</p> <p>### Workarounds It is not advised to work around this, but to upgrade MoinMoin to a patched version.</p> <p>That said, a work around via disabling the `cache` or the `AttachFile` action might be possible.</p> <p>Also, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.</p> <p>### Credits</p> <p>This vulnerability was discovered by Michael Chapman.</p> <p>### For more information If you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).</p> <p><strong>Affected:</strong> PyPI: moin</p> <p>### Impact The cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.</p> <p>### Patches Users are strongly advised to upgrade to a patched version.</p> <p>MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.</p> <p>### Workarounds It is not advised to work around this, but to upgrade MoinMoin to a patched version.</p> <p>That said, a work around via disabling the `cache` or the `AttachFile` action might be possible.</p> <p>Also, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.</p> <p>### Credits</p> <p>This vulnerability was discovered by Michael Chapman.</p> <p>### For more information If you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).</p> https://cve.radiocsirt.org/vuln/ghsa-52q8-877j-gghq