A remote code execution vulnerability was found in MoinMoin wiki, versions 1.9.x up to (and including) 1.9.5. The method save in class
AnyWikiDraw (action/anywikidraw.py) and class TWikiDraw (action/twikidraw.py) do not filter user supplied input correctly, which leads to a path traversal vulnerability, which can be exploited to execute arbitrary code with moin's privileges. An exploit was seen in the wild.
Details can be found at: http://moinmo.in/SecurityFixes
A fix is available at: http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f
This issue has been assigned CVE-2012-6081
Created moin tracking bugs for this issue
Affects: fedora-all [bug 890906]
Affects: epel-5 [bug 890907]
moin-1.9.6-1.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
moin-1.9.6-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
moin-1.9.6-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.