{"id":"CVE-2020-25074","aliases":["DLA-2446-1","DSA-4787-1","EUVD-2020-0114","GHSA-52q8-877j-gghq","PYSEC-2020-67","UBUNTU-CVE-2020-25074","USN-4629-1","openSUSE-SU-2020:1966-1","openSUSE-SU-2020:1998-1"],"status":"published","title":"MoinMoin vulnerable to remote code execution via cache action","description":"The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.06551,"percentile":0.93901,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2020-11-09T00:00:00Z","modified":"2026-10-20T10:52:52Z","fixes":[{"ecosystem":"PyPI","package":"moin","fixed_in":["1.9.11"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"moin","fixed_in":["1.9.8-1ubuntu1.16.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"moin","fixed_in":["1.9.9-1ubuntu1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1+deb9u2"}]}],"versions":["1.9.9-1","1.9.9-1+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1+deb10u1"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11"}]}],"versions":["1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1","1.9.10","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9"]},{"source":"osv","ecosystem":"PyPI","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11"}]}],"versions":["1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1","1.9.2","1.9.3","1.9.4","1.9.5","1.9.6","1.9.7","1.9.8","1.9.9","1.9.10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.8-1ubuntu1.16.04.3"}]}],"versions":["1.9.7-2ubuntu3","1.9.8-1ubuntu1","1.9.8-1ubuntu1.16.04.1","1.9.8-1ubuntu1.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1ubuntu1.2"}]}],"versions":["1.9.9-1ubuntu1","1.9.9-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.8-1ubuntu1.16.04.3"}]}],"versions":["1.9.7-2ubuntu3","1.9.8-1ubuntu1","1.9.8-1ubuntu1.16.04.1","1.9.8-1ubuntu1.16.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"moin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.9-1ubuntu1.2"}]}],"versions":["1.9.9-1ubuntu1","1.9.9-1ubuntu1.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"moinmoin-wiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11-lp152.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"moinmoin-wiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.11-bp152.4.3.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"moinmo","product":"moinmoin"}],"references":[{"url":"http://moinmo.in/SecurityFixes","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2020/dsa-4787","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/moinwiki/moin-1.9/security/advisories/GHSA-52q8-877j-gghq","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/11/msg00020.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://github.com/moinwiki/moin-1.9/commit/6b96a9060069302996b5af47fd4a388fc80172b7","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25074","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/moin/PYSEC-2020-67.yaml","tags":["web"]},{"url":"https://pypi.org/project/moin","tags":["web"]},{"url":"https://github.com/advisories/GHSA-52q8-877j-gghq"},{"url":"https://github.com/moinwiki/moin","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2020-25074","tags":["report"]},{"url":"https://github.com/moinwiki/moin-1.9/commit/d1e5fc7d3708d877353ca64dd4aa7cfd1cde4cb4","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4629-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25074","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15275","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZWQ3H4AUJA2F3ISKMWL6QTCZID5AYFKR/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178744","tags":["report"]},{"url":"https://bugzilla.suse.com/1178745","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25074","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GMUGPIPMLTP6KSHV2XRIESFS7OGOBXW6/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-25074","description":"The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.","status":"published","published":"2020-11-10T16:48:21Z","modified":"2024-08-04T15:26:09.287Z","updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2020-0114","description":"The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.","status":"published","published":"2020-11-10T16:48:21Z","modified":"2024-08-04T15:26:09Z","updated_at":"2026-11-03T03:07:18.658916Z"}],"ghsa":[{"id":"GHSA-52q8-877j-gghq","title":"MoinMoin vulnerable to remote code execution via cache action","description":"### Impact\nThe cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.\n\n### Patches\nUsers are strongly advised to upgrade to a patched version.\n\nMoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.\n\n### Workarounds\nIt is not advised to work around this, but to upgrade MoinMoin to a patched version.\n\nThat said, a work around via disabling the `cache` or the `AttachFile` action might be possible.\n\nAlso, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.\n\n### Credits\n\nThis vulnerability was discovered by Michael Chapman.\n\n### For more information\nIf you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).","status":"published","published":"2020-11-11T15:54:51Z","modified":"2024-10-07T14:54:34Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:38:08.742903Z"}],"nvd":[{"id":"CVE-2020-25074","description":"The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.","status":"published","published":"2020-11-10T17:15:12.907Z","modified":"2026-06-17T03:06:20.54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:24.137599Z"}],"osv":[{"id":"CVE-2020-25074","description":"The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.","status":"published","published":"2020-11-10T17:15:12.907Z","modified":"2026-10-20T10:52:52.480732094Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"GHSA-52q8-877j-gghq","title":"MoinMoin vulnerable to remote code execution via cache action","description":"### Impact\nThe cache action in action/cache.py allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.\n\n### Patches\nUsers are strongly advised to upgrade to a patched version.\n\nMoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.\n\n### Workarounds\nIt is not advised to work around this, but to upgrade MoinMoin to a patched version.\n\nThat said, a work around via disabling the `cache` or the `AttachFile` action might be possible.\n\nAlso, it is of course helpful if you give `write` permissions (which include uploading attachments) only to trusted users.\n\n### Credits\n\nThis vulnerability was discovered by Michael Chapman.\n\n### For more information\nIf you have any questions or comments about this advisory, email me at [twaldmann@thinkmo.de](mailto:twaldmann@thinkmo.de).","status":"published","published":"2020-11-11T15:54:51Z","modified":"2026-09-10T03:48:35.542355415Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"UBUNTU-CVE-2020-25074","description":"The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.","status":"published","published":"2020-11-09T00:00:00Z","modified":"2026-02-04T02:27:16.732598Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DLA-2446-1","title":"moin - security update","status":"published","published":"2020-11-10T00:00:00Z","modified":"2026-03-09T01:20:26.521246Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4787-1","title":"moin - security update","status":"published","published":"2020-11-09T00:00:00Z","modified":"2026-03-09T02:08:40.315399Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:1966-1","title":"Security update for moinmoin-wiki","description":"This update for moinmoin-wiki fixes the following issues:\n\n- update to version 1.9.11:\n  CVE-2020-25074 (boo#1178744): fix remote code execution via cache action\n  CVE-2020-15275 (boo#1178745): fix malicious SVG attachment causing stored XSS vulnerability\n","status":"published","published":"2020-11-19T07:33:28Z","modified":"2026-02-04T03:54:53.256679Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1998-1","title":"Security update for moinmoin-wiki","description":"This update for moinmoin-wiki fixes the following issues:\n\n- update to version 1.9.11:\n  CVE-2020-25074 (boo#1178744): fix remote code execution via cache action\n  CVE-2020-15275 (boo#1178745): fix malicious SVG attachment causing stored XSS vulnerability\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2020-11-23T07:20:43Z","modified":"2026-02-04T02:22:17.889395Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"PYSEC-2020-67","description":"The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.","status":"published","published":"2020-11-10T17:15:00Z","modified":"2023-11-08T04:03:09.606103Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"USN-4629-1","title":"moin vulnerabilities","description":"Michael Chapman discovered that MoinMoin incorrectly handled certain cache actions.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-25074)\n\nCatarina Leite discovered that MoinMoin incorrectly handled certain SVG files.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-15275)\n","status":"published","published":"2020-11-11T13:46:22Z","modified":"2026-02-10T04:41:58Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}