CVE-2020-15275: MoinMoin SVG File Upload Remote Code Execution
Summary
CVE-2020-15275: MoinMoin is a wiki engine. Affects moin across 2 version ranges.
< 1.9.11
< 31de9139d0aabc171e94032168399b4a0b2a88a2
Fixed in 31de9139d0aabc171e94032168399b4a0b2a88a2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MoinMoin is a popular wiki engine that allows users to create and edit content collaboratively. It provides a platform for creating and managing wikis, which are websites that allow users to contribute and modify content. MoinMoin supports various file types, including SVG (Scalable Vector Graphics) files, which are XML-based vector image formats. SVG files can contain embedded JavaScript code that is executed by web browsers when the file is rendered. This vulnerability in MoinMoin allows an attacker with write permissions to upload an SVG file containing malicious JavaScript code. When a user views the SVG file on the wiki, the JavaScript code is executed in their browser, potentially leading to remote code execution and other malicious activities.
Vulnerability Detail
The vulnerability in MoinMoin before version 1.9.11 arises from a lack of proper input validation and sanitization when handling SVG file uploads. An attacker who has write permissions on the wiki can upload an SVG file that includes malicious JavaScript code. This code will be executed in the context of the user's browser when they view the SVG file on the wiki. The consequences of this vulnerability can be severe, as it allows an attacker to execute arbitrary code on the victim's machine, potentially leading to unauthorized access, data theft, or further compromise of the system. It is crucial for users of MoinMoin to upgrade to version 1.9.11 or apply the necessary patches to mitigate this vulnerability.
How To Fix
Latest published version: 1.9.11 as of 22 Oct 2026
pip install --upgrade "moin==1.9.11"The newest release already contains this fix.
If you need the minimum change
31de9139d0aabc171e94032168399b4a0b2a88a2
This is the first release that contains the fix.
pip install --upgrade "moin==31de9139d0aabc171e94032168399b4a0b2a88a2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the ability to upload SVG files on their MoinMoin installations. By preventing the upload of SVG files, the risk of this vulnerability being exploited is mitigated. This can be achieved by modifying the configuration settings of MoinMoin to disallow SVG file uploads. However, this workaround may impact the functionality and user experience of the wiki, as SVG files will no longer be supported. It is advisable to implement this workaround only if immediate upgrade or patching is not possible.
Conclusion
The vulnerability in MoinMoin that allows for remote code execution through malicious SVG file uploads is a critical security issue. Users of MoinMoin are strongly advised to upgrade to version 1.9.11 or apply the necessary patches to mitigate this vulnerability. Disabling SVG file uploads can serve as a temporary workaround until the upgrade or patching process is completed. For further support and assistance in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for moin →
FAQ
MoinMoin is a wiki engine that allows users to create and edit content collaboratively. It provides a platform for creating and managing wikis, which are websites that allow users to contribute and modify content.
SVG (Scalable Vector Graphics) is an XML-based vector image format. It is widely used for displaying graphics and images on the web. SVG files can contain embedded JavaScript code that is executed by web browsers when the file is rendered.
The vulnerability in MoinMoin arises from a lack of proper input validation and sanitization when handling SVG file uploads. An attacker with write permissions can upload an SVG file that includes malicious JavaScript code. When a user views the SVG file on the wiki, the JavaScript code is executed in their browser.
The consequences of this vulnerability can be severe. An attacker can execute arbitrary code on the victim's machine, potentially leading to unauthorized access, data theft, or further compromise of the system.
To protect your MoinMoin installation, it is recommended to upgrade to version 1.9.11 or apply the provided patches. Additionally, you can disable the ability to upload SVG files as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for moin.
