{"id":"CVE-2020-15275","aliases":["DLA-2446-1","DSA-4787-1","EUVD-2020-0113","GHSA-4q96-6xhq-ff43","PYSEC-2020-241","UBUNTU-CVE-2020-15275","USN-4629-1","openSUSE-SU-2020:1966-1","openSUSE-SU-2020:1998-1"],"status":"published","title":"malicious SVG attachment causing stored XSS vulnerability in MoinMoin","description":"MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01746,"percentile":0.78128,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-11-09T00:00:00Z","modified":"2026-10-20T10:51:54Z","fixes":[{"ecosystem":"PyPI","package":"moin","fixed_in":["1.9.11"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"moin","fixed_in":["1.9.8-1ubuntu1.16.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"moin","fixed_in":["1.9.9-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1+deb9u2"}]}],"versions":["1.9.9-1","1.9.9-1+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1+deb10u1"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11"}]}],"versions":["1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1","1.9.10","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9"]},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"31de9139d0aabc171e94032168399b4a0b2a88a2"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11"}]}],"versions":["1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1","1.9.10","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.8-1ubuntu1.16.04.3"}]}],"versions":["1.9.7-2ubuntu3","1.9.8-1ubuntu1","1.9.8-1ubuntu1.16.04.1","1.9.8-1ubuntu1.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1ubuntu1.2"}]}],"versions":["1.9.9-1ubuntu1","1.9.9-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.8-1ubuntu1.16.04.3"}]}],"versions":["1.9.7-2ubuntu3","1.9.8-1ubuntu1","1.9.8-1ubuntu1.16.04.1","1.9.8-1ubuntu1.16.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1ubuntu1.2"}]}],"versions":["1.9.9-1ubuntu1","1.9.9-1ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"moinmoin-wiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11-lp152.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"moinmoin-wiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11-bp152.4.3.1"}]}],"bundled":2}],"products":[{"vendor":"moinmo","product":"moinmoin"},{"vendor":"moinwiki","product":"moin-1.9"}],"references":[{"url":"https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/moinwiki/moin-1.9/releases/tag/1.9.11","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/moinwiki/moin-1.9/commit/31de9139d0aabc171e94032168399b4a0b2a88a2","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://advisory.checkmarx.net/advisory/CX-2020-4285","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15275","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2020-241.yaml","tags":["web"]},{"url":"https://pypi.org/project/moin","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4q96-6xhq-ff43"},{"url":"https://github.com/moinwiki/moin-1.9","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-15275","tags":["report"]},{"url":"https://github.com/moinwiki/moin-1.9/commit/64e16037a60646a4d834f0203c75481b9c3fa74c","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4629-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15275","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25074","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZWQ3H4AUJA2F3ISKMWL6QTCZID5AYFKR/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178744","tags":["report"]},{"url":"https://bugzilla.suse.com/1178745","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25074","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GMUGPIPMLTP6KSHV2XRIESFS7OGOBXW6/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-15275","title":"malicious SVG attachment causing stored XSS vulnerability in MoinMoin","description":"MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.","status":"published","published":"2020-11-11T15:45:15Z","modified":"2024-08-04T13:15:19.004Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-0113","description":"MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.","status":"published","published":"2020-11-11T15:45:15Z","modified":"2024-08-04T13:15:19Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:07:31.955969Z"}],"ghsa":[{"id":"GHSA-4q96-6xhq-ff43","title":"malicious SVG attachment causing stored XSS vulnerability","description":"### Impact\nAn attacker with `write` permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki.\n\n### Patches\nUsers are strongly advised to upgrade to a patched version.\n\nMoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.\n\n### Workarounds\nIt is not advised to work around this, but to upgrade MoinMoin to a patched version.\n\nThat said, a work around via a Content Security Policy in the web server might be possible.\n\nAlso, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.\n\n### For more information\nIf you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).\n\n### Credits\n\nThis vulnerability was discovered by:\n\nCatarina Leite from the Checkmarx SCA AppSec team","status":"published","published":"2020-11-11T15:54:41Z","modified":"2024-10-07T15:01:09Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":6.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:08.742903Z"}],"nvd":[{"id":"CVE-2020-15275","description":"MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.","status":"published","published":"2020-11-11T16:15:13.237Z","modified":"2026-06-17T02:56:24.47Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:24.137599Z"}],"osv":[{"id":"CVE-2020-15275","description":"MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.","status":"published","published":"2020-11-11T16:15:13.237Z","modified":"2026-10-20T10:51:54.470327645Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-4q96-6xhq-ff43","title":"malicious SVG attachment causing stored XSS vulnerability","description":"### Impact\nAn attacker with `write` permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki.\n\n### Patches\nUsers are strongly advised to upgrade to a patched version.\n\nMoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.\n\n### Workarounds\nIt is not advised to work around this, but to upgrade MoinMoin to a patched version.\n\nThat said, a work around via a Content Security Policy in the web server might be possible.\n\nAlso, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.\n\n### For more information\nIf you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).\n\n### Credits\n\nThis vulnerability was discovered by:\n\nCatarina Leite from the Checkmarx SCA AppSec team","status":"published","published":"2020-11-11T15:54:41Z","modified":"2026-07-08T06:00:33.060527041Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":6.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"UBUNTU-CVE-2020-15275","description":"MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.","status":"published","published":"2020-11-09T00:00:00Z","modified":"2026-02-04T03:56:21.251925Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2446-1","title":"moin - security update","status":"published","published":"2020-11-10T00:00:00Z","modified":"2026-03-09T01:20:26.521246Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4787-1","title":"moin - security update","status":"published","published":"2020-11-09T00:00:00Z","modified":"2026-03-09T02:08:40.315399Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:1966-1","title":"Security update for moinmoin-wiki","description":"This update for moinmoin-wiki fixes the following issues:\n\n- update to version 1.9.11:\n  CVE-2020-25074 (boo#1178744): fix remote code execution via cache action\n  CVE-2020-15275 (boo#1178745): fix malicious SVG attachment causing stored XSS vulnerability\n","status":"published","published":"2020-11-19T07:33:28Z","modified":"2026-02-04T03:54:53.256679Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1998-1","title":"Security update for moinmoin-wiki","description":"This update for moinmoin-wiki fixes the following issues:\n\n- update to version 1.9.11:\n  CVE-2020-25074 (boo#1178744): fix remote code execution via cache action\n  CVE-2020-15275 (boo#1178745): fix malicious SVG attachment causing stored XSS vulnerability\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2020-11-23T07:20:43Z","modified":"2026-02-04T02:22:17.889395Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"PYSEC-2020-241","description":"MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.","status":"published","published":"2020-11-11T16:15:00Z","modified":"2023-11-08T04:02:36.383393Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"USN-4629-1","title":"moin vulnerabilities","description":"Michael Chapman discovered that MoinMoin incorrectly handled certain cache actions.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-25074)\n\nCatarina Leite discovered that MoinMoin incorrectly handled certain SVG files.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-15275)\n","status":"published","published":"2020-11-11T13:46:22Z","modified":"2026-02-10T04:41:58Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}