CVE-2013-2114
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6...
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Exploit likelihood
What each source reports
NVD Score used
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- Record
CVE-2013-2114- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- Record
CVE-2013-2114- Updated
- 2026-11-02
EUVDEUVD-2013-2084 No score
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- Record
EUVD-2013-2084- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3mhg-j5fx-98c7 No score
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6...
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- Record
GHSA-3mhg-j5fx-98c7- Updated
- 2026-11-02
OSV No score
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- Record
CVE-2013-2114- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2114 No score
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
- Record
DEBIAN-CVE-2013-2114- Updated
- 2026-11-02
OSVMGASA-2013-0221 No score
Updated mediawiki packages fix security vulnerability
MediaWiki user Marco discovered that security checks for file uploads were not being run when the file was uploaded in chunks through the API. This option has been available to users who can upload files since MediaWiki 1.19 (CVE-2013-2114).
- Record
MGASA-2013-0221- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2114 is a medium vulnerability (CVSS 6.8) in Mediawiki, published July 21, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.34%, the 83rd percentile. Fixed in mediawiki 1:1.19.7+dfsg-1.