CVE-2012-6495
MoinMoin Multiple vulnerable to directory traversal
CVE-2012-6495 is a medium vulnerability (CVSS 6.0) in Moinmo Moinmoin, published December 29, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.7%, the 97th percentile. Fixed in moin 1.9.6.
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
Exploit likelihood
What each source reports
NVD Score used
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
- Record
CVE-2012-6495- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
- Record
CVE-2012-6495- Updated
- 2026-11-02
EUVDEUVD-2013-0021 No score
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
- Record
EUVD-2013-0021- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6gx4-29v9-g9q5
MoinMoin Multiple vulnerable to directory traversal
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
- Record
GHSA-6gx4-29v9-g9q5- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-6gx4-29v9-g9q5
MoinMoin Multiple vulnerable to directory traversal
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
- Record
GHSA-6gx4-29v9-g9q5- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2013-7 No score
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.
- Record
PYSEC-2013-7- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moinPyPI |
before 1.9.6 | 1.9.6 |
moinDebian:6.0 |
before 1.9.3-1+squeeze4, plus listed versions 1.9.3-11.9.3-1+squeeze11.9.3-1+squeeze21.9.3-1+squeeze3 |
1.9.3-1+squeeze4 |
moinPyPI |
before 1.9.6, plus listed versions 1.8.41.8.51.8.61.8.71.9.0 Show 5 moreShow less1.9.11.9.21.9.31.9.41.9.5 |
1.9.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MoinMoin - Arbitrary Command Execution | 2013-05-08 |
| Exploit-DB | MoinMoin - twikidraw Action Traversal Arbitrary File Upload (Metasploit) | 2013-06-24 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
moinmo.in/MoinMoinRelease1.9
hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f
debian.org/security/2012/dsa-2593
bugs.launchpad.net/ubuntu/+source/moin/+bug/1094599
openwall.com/lists/oss-security/2012/12/29/6
Show 8 moreShow less
secunia.com/advisories/51696
ubuntu.com/usn/usn-1680-1
nvd.nist.gov/vuln/detail/CVE-2012-6495
web.archive.org/web/20151017045319/http://secunia.com/advisories/51696
github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2013-7.yaml