Description

MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file.

Remediation

References

CVE-2015-8005

Related Vulnerabilities

WordPress Plugin Form Manager Remote Command Execution (1.7.2)

WordPress Plugin Ultimate Responsive Image Slider Unspecified Vulnerability (3.3.2)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2026-32629)

WordPress Plugin Flash Photo Gallery Cross-Site Scripting (0.7)

WordPress Plugin Spectra-WordPress Gutenberg Blocks Security Bypass (1.14.7)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2015-8005