GHSA-6766-r2rx-mfw9

Source

https://github.com/advisories/GHSA-6766-r2rx-mfw9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6766-r2rx-mfw9/GHSA-6766-r2rx-mfw9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6766-r2rx-mfw9

Aliases

CVE-2008-0782
PYSEC-2026-668

Published

2022-05-01T23:33:03Z

Modified

2026-07-06T08:11:33Z

Summary

MoinMoin Directory traversal vulnerability

Details

Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the MOIN_ID user ID in a cookie for a userform action. NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter. The issue has been fixed on e69a16b6e630.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-05-14T20:41:31Z",
    "nvd_published_at":  "2008-02-14T21:00:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / moin

Package

Name: moin; View open source insights on deps.dev
Purl: pkg:pypi/moin

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

1.5.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6766-r2rx-mfw9/GHSA-6766-r2rx-mfw9.json"