CVE-2015-0844

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote...

5.0 MediumFix available

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

Exploit likelihood

2.31%Up 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

Record: CVE-2015-0844
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

Record: CVE-2015-0844
Updated: 2026-11-02

EUVDEUVD-2015-0856 No score

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

Record: EUVD-2015-0856
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fjh5-4xff-hw35 No score

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote...

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

Record: GHSA-fjh5-4xff-hw35
Weakness: CWE-200
Updated: 2026-11-02

OSVMGASA-2015-0154 No score

Updated wesnoth packages fix CVE-2015-0844

Updated wesnoth packages fix security vulnerability

A severe security vulnerability in Battle of Wesnoth's game client was found which could allow a malicious user to obtain personal files and information from other players in networked multiplayer games using the built-in WML/Lua API on any platform (CVE-2015-0844).

Upstream announces that all content currently on the official Wesnoth.org add-ons server (add-ons.wesnoth.org) has been inspected to confirm that none of it exploits this vulnerability.

Record: MGASA-2015-0154
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10261-1 No score

wesnoth-1.12.6-1.1 on GA media

These are all security issues fixed in the wesnoth-1.12.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10261-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-0844 No score

The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.

Record: UBUNTU-CVE-2015-0844
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`wesnoth-1.8` Debian:6.0	before 1:1.8.5-1+deb6u1, plus listed versions 1:1.8.5-1	1:1.8.5-1+deb6u1
`wesnoth-1.10` Debian:7	before 1:1.10.3-3+deb7u1, plus listed versions 1:1.10.3-31:1.10.3-3+deb7u1~bpo60+1	1:1.10.3-3+deb7u1
`wesnoth` Mageia:4	before 1.10.7-2.1.mga4	1.10.7-2.1.mga4
`wesnoth-1.10` Ubuntu:14.04:LTS	before 1:1.10.7-1ubuntu0.14.04.1, plus listed versions 1:1.10.6-2ubuntu11:1.10.6-2ubuntu21:1.10.7-1	1:1.10.7-1ubuntu0.14.04.1
`wesnoth` openSUSE:Tumbleweed	before 1.12.6-1.1	1.12.6-1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0844 is a medium vulnerability (CVSS 5.0) in Wesnoth Battle For Wesnoth, published April 10, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.31%, the 83rd percentile. Fixed in wesnoth-1.8 1:1.8.5-1+deb6u1.

References

Show 9 moreShow less