Description
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg function or (2) multiple vectors related to package file errors in the upload_form function, different vectors than CVE-2009-0260.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | moin | 1.7.1-3+lenny2 | DSA-1791-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | moin | < 1.8.3 | 1.8.3 | GHSA-4pfg-2frf-f67v |
Advisories 1
- DSA-1791-1 moin - cross-site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- moinmoin-errormsg-xss(50356) vdb-entry
- http://moinmo.in/SecurityFixes
- ADV-2009-1119 vdb-entry
- http://hg.moinmo.in/moin/1.8/rev/5f51246a4df1
- 34631 vdb-entry
- 35024 third-party-advisory
- 34945 third-party-advisory
- DSA-1791 vendor-advisory
- 34821 third-party-advisory
- USN-774-1 vendor-advisory