CVE-2010-0717: MoinMoin Packagepages_actions_excluded Unsafe Configuration
Summary
CVE-2010-0717: The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors. Affects moin versions < 1.8.7. Fixed in 1.8.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. The package in question, Moin, is available on the Python Package Index (PyPI) and is widely used for creating wikis. MoinMoin versions prior to 1.8.7 are affected by a vulnerability related to the default configuration of 'cfg.packagepages_actions_excluded'. This configuration does not prevent unsafe package actions, potentially leading to unspecified impacts and various attack vectors.
Vulnerability Detail
The vulnerability arises from the default configuration of 'cfg.packagepages_actions_excluded' in MoinMoin before version 1.8.7. This configuration oversight allows for the execution of unsafe package actions, but the exact impact and attack vectors are unspecified. It is crucial to note that this vulnerability can be exploited by attackers to compromise the security and integrity of MoinMoin installations.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.7
This is the first release that contains the fix.
pip install --upgrade "moin==1.8.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
The default configuration of 'cfg.packagepages_actions_excluded' in MoinMoin before version 1.8.7 allows for unsafe package actions, posing potential security risks. It is crucial to upgrade to MoinMoin 1.8.7 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
MoinMoin is an open-source wiki engine written in Python. It allows for collaborative content creation and editing.
'cfg.packagepages_actions_excluded' is a configuration option in MoinMoin that determines which package actions are excluded from being executed.
The exact impacts of this vulnerability are unspecified. However, it can potentially lead to unauthorized access, data manipulation, or other security breaches.
No, only versions prior to 1.8.7 are affected. It is recommended to upgrade to the latest version to mitigate the vulnerability.
You can find more information about this vulnerability in the MoinMoin advisory database: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for moin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
