CVE-2021-39186

MEDIUM 6.1CVE-2021-39186 · Published 01/09/2021 · updated 17/06/2026

In short

CVE-2021-39186 is a MEDIUM (CVSS 6.1) vulnerability affecting globalnewfiles (miraheze).
Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.0% of all vulnerabilities.
Fix: update to 2021-09-01 or later.

Package	Affected versions	Patched versions
globalnewfiles miraheze	`< 2021-09-01`	`2021-09-01`

Description

GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a workaround, one may disallow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible.

References

miraheze/GlobalNewFiles commit cee254e · Patch
miraheze/GlobalNewFiles security advisory · Third Party Advisory
phabricator.miraheze.org/T7935 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free