{"id":"CVE-2013-2114","aliases":["DEBIAN-CVE-2013-2114","EUVD-2013-2084","GHSA-3mhg-j5fx-98c7","MGASA-2013-0221"],"status":"published","title":"Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6...","description":"Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02344,"percentile":0.83762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-07-21T08:57:46Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.19.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.19.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.19.7+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"mediawiki","fixed_in":["1.20.6-1.2.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.7+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.6-1.2.mga3"}]}]}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"http://secunia.com/advisories/55433","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/24/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://security.gentoo.org/glsa/glsa-201310-21.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=48306","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-May/000131.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2114"},{"url":"https://github.com/advisories/GHSA-3mhg-j5fx-98c7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2114","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0221.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10784","tags":["report"]},{"url":"https://www.mediawiki.org/wiki/Release_notes/1.20#MediaWiki_1.20.6","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-2114","description":"Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.","status":"published","published":"2013-11-15T18:16:00Z","modified":"2024-09-16T23:41:52.131Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2084","description":"Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.","status":"published","published":"2013-11-15T18:16:00Z","modified":"2024-09-16T23:41:52Z","updated_at":"2026-11-03T00:54:47.592767Z"}],"ghsa":[{"id":"GHSA-3mhg-j5fx-98c7","title":"Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6...","description":"Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.","status":"published","published":"2022-05-17T04:57:49Z","modified":"2023-01-28T05:02:52Z","updated_at":"2026-11-02T14:43:51.685777Z"}],"nvd":[{"id":"CVE-2013-2114","description":"Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.","status":"published","published":"2013-11-18T02:55:07.577Z","modified":"2026-06-16T23:52:46.33Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:40.988689Z"}],"osv":[{"id":"CVE-2013-2114","description":"Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.","status":"published","published":"2013-11-18T02:55:07Z","modified":"2026-04-16T06:24:16.739375609Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2114","description":"Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.","status":"published","published":"2013-11-18T02:55:07.577Z","modified":"2026-09-01T20:03:15.515737119Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0221","title":"Updated mediawiki packages fix security vulnerability","description":"MediaWiki user Marco discovered that security checks for file uploads were\nnot being run when the file was uploaded in chunks through the API. This\noption has been available to users who can upload files since MediaWiki\n1.19 (CVE-2013-2114).\n","status":"published","published":"2013-07-21T08:57:46Z","modified":"2026-04-16T06:25:30.084117153Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}