{
  "cveId": "CVE-2023-36674",
  "url": "https://patchblox.com/security/cve/CVE-2023-36674",
  "summary": "CVE-2023-36674 is fixed in mediawiki on 1 platform, first by DEBIAN-CVE-2023-36674, released August 20, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "mediawiki: An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1...",
  "description": "An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to bypass the Bad image list (aka badFile) by using the thumb parameter (aka Manualthumb) of the File syntax.",
  "published": "2023-08-20T18:15:09Z",
  "severity": "medium",
  "cvss": 5.3,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "epss": 0.00737,
  "epssPercentile": 0.54771,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "mediawiki",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1:1.39.4-1~deb12u1",
      "fix": "DEBIAN-CVE-2023-36674",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-36674",
      "released": "2023-08-20T18:15:09Z"
    },
    {
      "platform": "linux",
      "product": "mediawiki",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:1.39.4-1",
      "fix": "DEBIAN-CVE-2023-36674",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-36674",
      "released": "2023-08-20T18:15:09Z"
    },
    {
      "platform": "linux",
      "product": "mediawiki",
      "release": "Debian 14",
      "fixedVersion": "1:1.39.4-1",
      "fix": "DEBIAN-CVE-2023-36674",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-36674",
      "released": "2023-08-20T18:15:09Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}