Description
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) message, (2) pagename, and (3) target filenames.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | moin | 1.5.3-1.2etch1 | DSA-1514-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | moin | <= 1.5.8 | — | GHSA-775g-4482-pm94 |
Advisories 1
- DSA-1514-1 moin Debian Security (DSA / DLA) · Mar 9, 2026
References
- 33755 third-party-advisory
- GLSA-200803-27 vendor-advisory
- 29262 third-party-advisory
- 29010 third-party-advisory
- FEDORA-2008-1880 vendor-advisory
- 28987 third-party-advisory
- ADV-2008-0569 vdb-entry
- 27904 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=432748
- 29444 third-party-advisory
- FEDORA-2008-1905 vendor-advisory
- http://hg.moinmo.in/moin/1.5/rev/db212dfc58ef
- USN-716-1 vendor-advisory
- DSA-1514 vendor-advisory