Description
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
Remediation
References
Related Vulnerabilities
WordPress Plugin TinyMCE Advanced Cross-Site Request Forgery (4.1)
phpMyAdmin URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2017-1000013)
Oracle Database Server Other Vulnerability (CVE-2001-0832)
WordPress 6.0.x Multiple Vulnerabilities (6.0 - 6.0.5)
WordPress Plugin Campaign URL Builder Cross-Site Scripting (1.8.1)