CVE-2012-6495: Directory Traversal Vulnerabilities in MoinMoin
Summary
CVE-2012-6495: Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions... Affects moin versions < 1.9.6. Fixed in 1.9.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is an open-source wiki engine written in Python. It provides a platform for collaborative content creation and editing. The affected package, 'moin', is a PyPI package that includes the MoinMoin software. MoinMoin allows users to create and modify wiki pages, and it supports various actions and functionalities. However, versions prior to 1.9.6 of MoinMoin are vulnerable to multiple directory traversal vulnerabilities.
Vulnerability Detail
The directory traversal vulnerabilities exist in the 'twikidraw' and 'anywikidraw' actions of MoinMoin. These actions allow remote authenticated users with write permissions to overwrite arbitrary files on the server. The exact vectors for exploitation are unspecified. However, an attacker with write permissions can leverage these vulnerabilities, along with CVE-2012-6081, to execute arbitrary code on the affected system. This can lead to unauthorized access, data manipulation, and potential system compromise.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.6
This is the first release that contains the fix.
pip install --upgrade "moin==1.9.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted and authenticated users have write permissions on the MoinMoin server. Additionally, implementing proper access controls and monitoring can help detect and prevent unauthorized file modifications.
Conclusion
The directory traversal vulnerabilities in MoinMoin versions prior to 1.9.6 can allow remote authenticated users to overwrite arbitrary files and potentially execute arbitrary code. It is crucial to upgrade to the latest version of MoinMoin to mitigate these vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
MoinMoin is an open-source wiki engine written in Python. It allows users to create and edit wiki pages collaboratively.
Versions of MoinMoin prior to 1.9.6 are affected by the directory traversal vulnerabilities.
The vulnerabilities allow remote authenticated users with write permissions to overwrite arbitrary files on the server. This can lead to unauthorized access, data manipulation, and potential system compromise.
To fix the vulnerability, it is recommended to upgrade to MoinMoin version 1.9.6 or later.
While no specific workaround is mentioned, users can mitigate the risk by ensuring proper access controls and monitoring on the MoinMoin server.
Related vulnerabilities
Recent vulnerabilities recorded for moin.
