CVE-2023-36674
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x...
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
- Record
CVE-2023-36674- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
- Record
CVE-2023-36674- Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2023-40617 No score
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
- Record
EUVD-2023-40617- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5998-5c6q-8v55
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x...
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
- Record
GHSA-5998-5c6q-8v55- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-36674
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
- Record
DEBIAN-CVE-2023-36674- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-36674
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
- Record
UBUNTU-CVE-2023-36674- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVBIT-mediawiki-2023-36674 No score
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
- Record
BIT-mediawiki-2023-36674- Updated
- 2026-11-02
OSV No score
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.
- Record
CVE-2023-36674- Updated
- 2026-11-02
OSVMGASA-2023-0241 No score
Updated mediawiki packages fix security vulnerability
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n (CVE-2023-29197).
Manualthumb bypasses badFile lookup (CVE-2023-36674).
XSS in BlockLogFormatter due to unsafe message use (CVE-2023-36675).
- Record
MGASA-2023-0241- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiBitnami |
before 1.35.11, 1.36.0 up to 1.38.7, 1.39.0 up to 1.39.4, 1.40.0 up to 1.40.1 | 1.35.111.38.71.39.41.40.1 |
mediawikiDebian:12 |
before 1:1.39.4-1~deb12u1, plus listed versions 1:1.39.2-1 |
1:1.39.4-1~deb12u1 |
mediawikiDebian:13 |
before 1:1.39.4-1 | 1:1.39.4-1 |
mediawikiDebian:14 |
before 1:1.39.4-1 | 1:1.39.4-1 |
mediawikiDebian:11 From an advisory covering 3 CVEs |
before 1:1.35.11-1~deb11u1, plus listed versions 1:1.35.2-11:1.35.3-11:1.35.4-11:1.35.4-1+deb11u21:1.35.4-1~deb11u1 Show 7 moreShow less1:1.35.5-11:1.35.5-21:1.35.6-11:1.35.7-11:1.35.8-11:1.35.8-1.11:1.35.8-1~deb11u1 |
1:1.35.11-1~deb11u1 |
mediawikiDebian:12 From an advisory covering 3 CVEs |
before 1:1.39.4-1~deb12u1, plus listed versions 1:1.39.2-1 |
1:1.39.4-1~deb12u1 |
mediawikiMageia:8 From an advisory covering 3 CVEs |
before 1.35.11-1.mga8 | 1.35.11-1.mga8 |
mediawikiUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 |
None known |
mediawikiUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.31.2-1ubuntu11:1.31.5-11:1.31.5-1ubuntu11:1.31.5-21:1.31.5-3 Show 4 moreShow less1:1.31.5-3ubuntu11:1.31.6-11:1.31.7-11:1.31.7-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1:1.35.3-11:1.35.4-11:1.35.5-11:1.35.5-1ubuntu11:1.35.5-1ubuntu21:1.35.5-1ubuntu31:1.35.6-11:1.35.6-1ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36674 is a medium vulnerability (CVSS 5.3) in Mediawiki, published July 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in mediawiki 1.35.11.
References
phabricator.wikimedia.org/T335612
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O
nvd.nist.gov/vuln/detail/CVE-2023-36674
Show 11 moreShow less
github.com/advisories/GHSA-5998-5c6q-8v55
security-tracker.debian.org/tracker/CVE-2023-36674
advisories.mageia.org/MGASA-2023-0241.html
bugs.mageia.org/show_bug.cgi?id=32083
lists.wikimedia.org/hyperkitty/list/[email protected]/thread/HVT3U3XYY35PSCIQPHMY4VQNF3Q6MHUO
ubuntu.com/security/CVE-2023-36674
gerrit.wikimedia.org/r/c/mediawiki/core/+/934571
cve.org/CVERecord?id=CVE-2023-36674