CVE-2011-0537

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-02-04 · updated 2026-06-16
Weakness: CWE-22

Description

Multiple directory traversal vulnerabilities in (1) languages/Language.php and (2) includes/StubObject.php in MediaWiki 1.8.0 and other versions before 1.16.2, when running on Windows and possibly Novell Netware, allow remote attackers to include and execute arbitrary local PHP files via vectors related to a crafted language file and the Language::factory function.

Affected products

Wikimedia Foundation MediaWiki: 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5 (+48)

References

http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.2.patch.gz
http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html
http://osvdb.org/70798
http://osvdb.org/70799
http://www.openwall.com/lists/oss-security/2011/02/01/4
http://www.openwall.com/lists/oss-security/2011/02/03/3
http://www.vupen.com/english/advisories/2011/0273
https://bugzilla.wikimedia.org/show_bug.cgi?id=27094
http://download.wikimedia.org/mediawiki/1.16/mediawiki-1.16.2.patch.gz
http://lists.wikimedia.org/pipermail/mediawiki-announce/2011-February/000095.html
http://osvdb.org/70798
http://osvdb.org/70799

Get alerted when CVE-2011-0537 or the next vulnerability affects your stack