CVE-2015-8001

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-11-09 · updated 2026-06-17
Weakness: CWE-284

Description

The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size.

Affected products

Wikimedia Foundation MediaWiki: through 1.23.10; 1.24.0, 1.24.1, 1.24.2, 1.24.3, 1.25.0, 1.25.1 (+1)

References

http://www.securitytracker.com/id/1034028
https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html
https://phabricator.wikimedia.org/T91203
http://www.securitytracker.com/id/1034028
https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-October/000181.html
https://phabricator.wikimedia.org/T91203

Get alerted when CVE-2015-8001 or the next vulnerability affects your stack