CVE-2020-25074
MoinMoin vulnerable to remote code execution via cache action
CVE-2020-25074 is a critical vulnerability (CVSS 9.8) in Moinmo Moinmoin, published November 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.55%, the 93rd percentile. Fixed in moin 1.9.11.
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
- Record
CVE-2020-25074- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
- Record
CVE-2020-25074- Updated
- 2026-11-02
EUVDEUVD-2020-0114 No score
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
- Record
EUVD-2020-0114- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-52q8-877j-gghq
MoinMoin vulnerable to remote code execution via cache action
Impact
The cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
Patches
Users are strongly advised to upgrade to a patched version.
MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
Workarounds
It is not advised to work around this, but to upgrade MoinMoin to a patched version.
That said, a work around via disabling the cache or the AttachFile action might be possible.
Also, it is of course helpful if you give write permissions (which include uploading attachments) only to trusted users.
Credits
This vulnerability was discovered by Michael Chapman.
For more information
If you have any questions or comments about this advisory, email me at [email protected].
- Record
GHSA-52q8-877j-gghq- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
- Record
CVE-2020-25074- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-52q8-877j-gghq
MoinMoin vulnerable to remote code execution via cache action
Impact
The cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
Patches
Users are strongly advised to upgrade to a patched version.
MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
Workarounds
It is not advised to work around this, but to upgrade MoinMoin to a patched version.
That said, a work around via disabling the cache or the AttachFile action might be possible.
Also, it is of course helpful if you give write permissions (which include uploading attachments) only to trusted users.
Credits
This vulnerability was discovered by Michael Chapman.
For more information
If you have any questions or comments about this advisory, email me at [email protected].
- Record
GHSA-52q8-877j-gghq- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2020-25074
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
- Record
UBUNTU-CVE-2020-25074- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1966-1 No score
Security update for moinmoin-wiki
This update for moinmoin-wiki fixes the following issues:
- update to version 1.9.11: CVE-2020-25074 (boo#1178744): fix remote code execution via cache action CVE-2020-15275 (boo#1178745): fix malicious SVG attachment causing stored XSS vulnerability
- Record
openSUSE-SU-2020:1966-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1998-1 No score
Security update for moinmoin-wiki
This update for moinmoin-wiki fixes the following issues:
- update to version 1.9.11: CVE-2020-25074 (boo#1178744): fix remote code execution via cache action CVE-2020-15275 (boo#1178745): fix malicious SVG attachment causing stored XSS vulnerability
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2020:1998-1- Updated
- 2026-11-02
OSVPYSEC-2020-67 No score
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
- Record
PYSEC-2020-67- Updated
- 2026-11-02
OSVUSN-4629-1 No score
moin vulnerabilities
Michael Chapman discovered that MoinMoin incorrectly handled certain cache actions. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-25074)
Catarina Leite discovered that MoinMoin incorrectly handled certain SVG files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-15275)
- Record
USN-4629-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
moinPyPI |
before 1.9.11 | 1.9.11 |
moinDebian:9 |
before 1.9.9-1+deb9u2, plus listed versions 1.9.9-11.9.9-1+deb9u1 |
1.9.9-1+deb9u2 |
moinDebian:10 |
before 1.9.9-1+deb10u1 | 1.9.9-1+deb10u1 |
moinPyPI |
before 1.9.11, plus listed versions 1.8.41.8.51.8.61.8.71.9.0 Show 10 moreShow less1.9.11.9.101.9.21.9.31.9.41.9.51.9.61.9.71.9.81.9.9 |
1.9.11 |
moinPyPI |
before 1.9.11, plus listed versions 1.8.41.8.51.8.61.8.71.9.0 Show 10 moreShow less1.9.11.9.21.9.31.9.41.9.51.9.61.9.71.9.81.9.91.9.10 |
1.9.11 |
moinUbuntu:16.04:LTS |
before 1.9.8-1ubuntu1.16.04.3, plus listed versions 1.9.7-2ubuntu31.9.8-1ubuntu11.9.8-1ubuntu1.16.04.11.9.8-1ubuntu1.16.04.2 |
1.9.8-1ubuntu1.16.04.3 |
moinUbuntu:18.04:LTS |
before 1.9.9-1ubuntu1.2, plus listed versions 1.9.9-1ubuntu11.9.9-1ubuntu1.1 |
1.9.9-1ubuntu1.2 |
moinmoin-wikiopenSUSE:Leap 15.2 |
before 1.9.11-lp152.3.3.1 | 1.9.11-lp152.3.3.1 |
moinmoin-wikiSUSE:Package Hub 15 SP2 |
before 1.9.11-bp152.4.3.1 | 1.9.11-bp152.4.3.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
moinmo.in/SecurityFixes
debian.org/security/2020/dsa-4787
github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq
lists.debian.org/debian-lts-announce/2020/11/msg00020.html
nvd.nist.gov/vuln/detail/CVE-2020-25074
Show 15 moreShow less
pypi.org/project/moin
ubuntu.com/security/CVE-2020-25074
cve.org/CVERecord?id=CVE-2020-25074
lists.opensuse.org/archives/list/[email protected]/thread/ZWQ3H4AUJA2F3ISKMWL6QTCZID5AYFKR
bugzilla.suse.com/1178744
suse.com/security/cve/CVE-2020-15275