CVE-2014-1610

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

• CWE-20

• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.htmlVendor Advisory
• http://osvdb.org/102630
• http://secunia.com/advisories/56695Vendor Advisory
• http://secunia.com/advisories/57472
• http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html
• http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
• http://www.debian.org/security/2014/dsa-2891
• http://www.exploit-db.com/exploits/31329/
• http://www.osvdb.org/102631
• http://www.securityfocus.com/bid/65223
• http://www.securitytracker.com/id/1029707
• https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff
• https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff
• https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
• https://gerrit.wikimedia.org/r/#/c/110069/Vendor Advisory
• https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php
• https://gerrit.wikimedia.org/r/#/c/110215/
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.htmlVendor Advisory
• http://osvdb.org/102630
• http://secunia.com/advisories/56695Vendor Advisory
• http://secunia.com/advisories/57472
• http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html
• http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
• http://www.debian.org/security/2014/dsa-2891
• http://www.exploit-db.com/exploits/31329/
• http://www.osvdb.org/102631
• http://www.securityfocus.com/bid/65223
• http://www.securitytracker.com/id/1029707
• https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff
• https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff
• https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
• https://gerrit.wikimedia.org/r/#/c/110069/Vendor Advisory
• https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php
• https://gerrit.wikimedia.org/r/#/c/110215/

Published

Jan 30, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-1599Multiple cross-site scripting (XSS) vulnerabilities in the S…
• CVE-2014-1603Multiple cross-site scripting (XSS) vulnerabilities in GetSi…
• CVE-2014-1604The parser cache functionality in parsergenerator.py in RPLY…
• CVE-2014-1607Cross-site scripting (XSS) vulnerability in the EventCalenda…
• CVE-2014-1608SQL injection vulnerability in the mci_file_get function in …
• CVE-2014-1609Multiple SQL injection vulnerabilities in MantisBT before 1.…
• CVE-2014-1611Cross-site scripting (XSS) vulnerability in the Anonymous Po…
• CVE-2014-1612Cross-site scripting (XSS) vulnerability in login.esp in the…
• CVE-2014-1613Dotclear before 2.6.2 allows remote attackers to execute arb…
• CVE-2014-1615Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2014-1617Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start B…6.5
• CVE-2014-1618Multiple SQL injection vulnerabilities in UAEPD Shopping Car…