Description
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mediawiki | 1:1.19.11+dfsg-1 | — |
| Debian 13 | mediawiki | 1:1.19.11+dfsg-1 | — |
| Debian 12 | mediawiki | 1:1.19.11+dfsg-1 | — |
| Debian 7 | mediawiki | 1:1.19.14+dfsg-0+deb7u1 | DSA-2891-1 |
| Debian 7 | mediawiki-extensions | 3.5~deb7u1 | DSA-2891-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
MediaWiki Thumb.php Remote Command Execution
exploit/multi/http/mediawiki_thumb
Exploit-DB 2
- MediaWiki - 'Thumb.php' Remote Command Execution (Metasploit) EDB-31767 · remote · Feb 19, 2014 · verified
- MediaWiki 1.22.1 PdfHandler - Remote Code Execution EDB-31329 · webapps · Feb 1, 2014 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-2891-1 mediawiki - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 31329 exploit
- http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
- http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
- 57472 third-party-advisory
- https://gerrit.wikimedia.org/r/#/c/110215/
- DSA-2891 vendor-advisory
- [MediaWiki-announce] 20140128 MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11 mailing-list
- 1029707 vdb-entry
- 65223 vdb-entry
- FEDORA-2014-1802 vendor-advisory
- https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php
- 102631 vdb-entry
- https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff
- https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff
- 56695 third-party-advisory
- https://gerrit.wikimedia.org/r/#/c/110069/
- 102630 vdb-entry
- FEDORA-2014-1745 vendor-advisory