CVE-2020-15275: MoinMoin Wiki - Malicious SVG Attachment Stored XSS Vulnerability
Summary
CVE-2020-15275: malicious SVG attachment causing stored XSS vulnerability. Affects moin versions < 1.9.11. Fixed in 1.9.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin Wiki is an open-source wiki software written in Python. It allows users to create and edit content collaboratively. The software supports various features such as page editing, file attachments, and user permissions. However, a vulnerability has been discovered in MoinMoin Wiki versions prior to 1.9.11 that allows an attacker with write permissions to upload an SVG file containing malicious JavaScript. When a user views the SVG file on the wiki, the malicious JavaScript is executed in their browser, leading to a stored cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability arises from the lack of proper input validation and sanitization of SVG file uploads. By uploading an SVG file with embedded malicious JavaScript, an attacker can exploit this vulnerability to execute arbitrary code in the context of other users who view the SVG file. This can lead to various consequences, including unauthorized access to sensitive information, session hijacking, and potential further exploitation of the affected system. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2020-15275. The vulnerability has a CVSS score of 8.7, indicating a high severity level.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While it is not recommended to rely solely on workarounds, a Content Security Policy (CSP) can be implemented in the web server configuration to mitigate the risk of this vulnerability. The CSP should restrict the execution of scripts from external sources and only allow trusted sources. However, implementing a CSP may have implications on the functionality of the wiki, and it is still recommended to upgrade to the patched version as the primary solution.
Conclusion
The MoinMoin Wiki software prior to version 1.9.11 is vulnerable to a stored XSS vulnerability that allows an attacker to execute arbitrary JavaScript code in the browsers of users who view a malicious SVG file. To mitigate this vulnerability, it is crucial to upgrade to MoinMoin Wiki version 1.9.11 or later. Implementing a Content Security Policy (CSP) as a temporary workaround may also help reduce the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the browsers of users who view a malicious SVG file on the MoinMoin Wiki. This can lead to unauthorized access, session hijacking, and potential further exploitation of the affected system.
This vulnerability was discovered by Catarina Leite from the Checkmarx SCA AppSec team.
No, only versions prior to 1.9.11 are affected. It is recommended to upgrade to version 1.9.11 or later to mitigate the vulnerability.
A Content Security Policy (CSP) can be implemented in the web server configuration to mitigate the risk. However, upgrading to the patched version is the recommended solution.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for moin.
