Description
The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 10 | moin | 1.9.9-1+deb10u1 | DSA-4787-1 |
| Debian 9 | moin | 1.9.9-1+deb9u2 | DLA-2446-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | moin | 1.9.9-1ubuntu1.2 | USN-4629-1 |
| Ubuntu 16.04 LTS | moin | 1.9.8-1ubuntu1.16.04.3 | USN-4629-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP2 | moinmoin-wiki | 1.9.11-bp152.4.3.1 | openSUSE-SU-2020:1998-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | moinmoin-wiki | 1.9.11-lp152.3.3.1 | openSUSE-SU-2020:1966-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | moin | < 1.9.11 | 1.9.11 | GHSA-52q8-877j-gghq |
Advisories 5
- DSA-4787-1 moin - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2446-1 moin - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4629-1 moin vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2020:1966-1 Security update for moinmoin-wiki SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1998-1 Security update for moinmoin-wiki SUSE / openSUSE Security Updates · Feb 4, 2026