CVE-2012-6080

Name of the Vulnerable Software and Affected Versions MoinMoin versions 1.9.3 through 1.9.5

Description The issue allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name, due to a directory traversal vulnerability in the do attachment move function in the AttachFile action (action/AttachFile.py).

Recommendations For MoinMoin versions 1.9.3 through 1.9.5, consider disabling the do attachment move function in the AttachFile action until a patch is available. Restrict access to the AttachFile action to minimize the risk of exploitation. Avoid using file names containing .. (dot dot) in the affected AttachFile action until the issue is resolved.