CVE-2009-1482: Cross-Site Scripting (XSS) Vulnerabilities in MoinMoin
Summary
CVE-2009-1482: Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg fu... Affects moin versions < 1.8.3. Fixed in 1.8.3. How to fix ↓
Also tracked for
- moin · Debian:10
The same CVE-2009-1482 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. MoinMoin versions 1.8.2 and earlier are affected by multiple cross-site scripting (XSS) vulnerabilities.
Vulnerability Detail
The vulnerabilities in MoinMoin allow remote attackers to inject arbitrary web script or HTML. The first vulnerability is found in the AttachFile.py file, specifically in the error_msg function's AttachFile sub-action. The second vulnerability is related to package file errors in the upload_form function. These vulnerabilities can be exploited by attackers to execute malicious scripts or steal sensitive information from users who visit the affected MoinMoin instance.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.3
This is the first release that contains the fix.
pip install --upgrade "moin==1.8.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for these vulnerabilities. It is advised to apply the recommended fix by upgrading to the latest version of MoinMoin.
Conclusion
The vulnerabilities in MoinMoin versions 1.8.2 and earlier allow for cross-site scripting attacks, potentially leading to unauthorized access or data theft. It is crucial to upgrade to version 1.8.3 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
These vulnerabilities allow attackers to inject malicious scripts or HTML, potentially leading to unauthorized access, data theft, or the execution of arbitrary code on the affected MoinMoin instance.
No, only MoinMoin versions 1.8.2 and earlier are vulnerable. Upgrading to version 1.8.3 or later resolves the issue.
Yes, remote attackers can exploit these vulnerabilities by sending specially crafted requests to the affected MoinMoin instance.
There is no specific evidence mentioned in the vulnerability report. However, it is always recommended to promptly apply security patches to mitigate potential risks.
You can find more information about these vulnerabilities in the vulnerability report available at the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for moin.
