Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2023-36674 — MEDIUM severity vulnerability | Release Alert

CVE-2023-36674

5.3

MEDIUMCVSS v3

Published

August 20, 2023

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.

wikimedia/mediawiki

GitHub🌻 The collaborative editing software that runs Wikipedia. Mirror from https://gerrit.wikimedia.org/g/mediawiki/core. See https://mediawiki.org/wiki/Developer_access for contributing.

>= 1.39.0, < 1.39.4, >= 1.36.0, < 1.38.7, < 1.35.11, = 1.40.0NVD

bitnami/mediawiki

Docker Hub🛑 DEPRECATED Bitnami Docker Image for MediaWiki

>= 1.39.0, < 1.39.4, >= 1.36.0, < 1.38.7, < 1.35.11, = 1.40.0NVD

More on this CVE

NVD↗GitHub Advisory↗

Docker HubMediaWiki is a free software open source wiki package written in PHP.

>= 1.39.0, < 1.39.4, >= 1.36.0, < 1.38.7, < 1.35.11, = 1.40.0NVD

NPMA JavaScript framework for the MediaWiki API.

>= 1.39.0, < 1.39.4, >= 1.36.0, < 1.38.7, < 1.35.11, = 1.40.0NVD

Python Package IndexMediaWiki Syntax to HTML

>= 1.39.0, < 1.39.4, >= 1.36.0, < 1.38.7, < 1.35.11, = 1.40.0NVD

Crates.ioA MediaWiki client library

>= 1.39.0, < 1.39.4, >= 1.36.0, < 1.38.7, < 1.35.11, = 1.40.0NVD