CVE-2012-6081: Unrestricted File Upload Vulnerabilities in MoinMoin
Summary
CVE-2012-6081: Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permis... Affects moin versions < 1.9.6. Fixed in 1.9.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. The twikidraw and anywikidraw actions in MoinMoin versions prior to 1.9.6 allow authenticated users with write permissions to upload files without proper validation. This vulnerability enables attackers to execute arbitrary code by uploading a file with an executable extension and accessing it via a direct request to the file in an unspecified directory. The vulnerability was exploited in the wild in July 2012.
Vulnerability Detail
The unrestricted file upload vulnerabilities in MoinMoin versions prior to 1.9.6 allow remote authenticated users to execute arbitrary code. By exploiting these vulnerabilities, an attacker with write permissions can upload a file with an executable extension. The attacker can then access the uploaded file directly, triggering the execution of the arbitrary code. This can lead to various consequences, including remote code execution, unauthorized access, and data manipulation.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.6
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to MoinMoin version 1.9.6 is not immediately feasible, users can implement a temporary workaround by disabling the affected actions (twikidraw and anywikidraw). This can be done by modifying the MoinMoin configuration to remove or restrict access to these actions. By disabling the vulnerable actions, the risk of unauthorized file uploads and code execution can be mitigated.
Conclusion
The unrestricted file upload vulnerabilities in MoinMoin versions prior to 1.9.6 pose a significant security risk, allowing remote authenticated users to execute arbitrary code. It is crucial to upgrade to MoinMoin version 1.9.6 or later to mitigate this vulnerability. If immediate upgrading is not possible, disabling the affected actions can provide temporary protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
The vulnerabilities allow remote authenticated users to execute arbitrary code, potentially leading to remote code execution, unauthorized access, and data manipulation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your MoinMoin installation is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities, including CVE-2012-6081.
Yes, these vulnerabilities were exploited in the wild in July 2012.
Yes, you can temporarily disable the affected actions (twikidraw and anywikidraw) in the MoinMoin configuration to mitigate the risk of unauthorized file uploads and code execution.
You can find more information about this vulnerability in the MoinMoin advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/moin/PYSEC-2013-6.yaml
Related vulnerabilities
Recent vulnerabilities recorded for moin.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
