CVE-2012-6495

MoinMoin < 1.9.6 - Authenticated Path Traversal and Arbitrary File Write via Twikidraw and Anywikidraw Actions

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2012-6495. PoCs published by Metasploit, HTP.

AI-analyzed exploit summary This Metasploit module exploits a directory traversal vulnerability in MoinMoin 1.9.5 to upload arbitrary files via the twikidraw action, allowing remote code execution by overwriting the moin.wsgi file. It includes authentication handling and attempts to restore the original file post-exploitation.

Description

Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotelinux
https://www.exploit-db.com/exploits/26422

This Metasploit module exploits a directory traversal vulnerability in MoinMoin 1.9.5 to upload arbitrary files via the twikidraw action, allowing remote code execution by overwriting the moin.wsgi file. It includes authentication handling and attempts to restore the original file post-exploitation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: MoinMoin 1.9.5
Auth required
Prerequisites: Apache/mod_wsgi configuration · Writable page with edit permissions
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by HTP · pythonwebappsphp
https://www.exploit-db.com/exploits/25304

This Python script exploits CVE-2012-6081, a remote code execution vulnerability in MoinMoin wiki software. It allows an attacker to upload a malicious file to the WikiSandBox page, enabling either a stealth webshell or a backconnect shell depending on the chosen method.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: MoinMoin Wiki (versions affected by CVE-2012-6081)
Auth required
Prerequisites: Access to an editable WikiSandBox page · Valid credentials if authorization is required
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (9)

Core 9
Core References
Vendor Advisory x_refsource_confirm
http://moinmo.in/MoinMoinRelease1.9
Various Sources x_refsource_confirm
http://moinmo.in/SecurityFixes
Exploit, Patch x_refsource_confirm
http://hg.moinmo.in/moin/1.9/rev/7e7e1cbb9d3f
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2593
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/12/29/6
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/12/30/4
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/51696
Various Sources vendor-advisory x_refsource_ubuntu
http://ubuntu.com/usn/usn-1680-1

Scores

EPSS 0.0987
EPSS Percentile 93.2%

Details

CWE
CWE-22
Status published
Products (36)
moinmo/moinmoin 0.1
moinmo/moinmoin 0.2
moinmo/moinmoin 0.3
moinmo/moinmoin 0.4
moinmo/moinmoin 0.5
moinmo/moinmoin 0.6
moinmo/moinmoin 0.7
moinmo/moinmoin 0.8
moinmo/moinmoin 0.9
moinmo/moinmoin 0.10
... and 26 more
Published Jan 03, 2013
Tracked Since Feb 18, 2026