MediaWiki CVE-2015-8005 Local Path Disclosure via ImageMagick Thumbnail Metadata

Key Vulnerability Information Vulnerability Title: Local path disclosure when using ImageMagick as a scaler Status: Closed, Resolved Type: Vulnerability - Infoleak Related Teams: Security-Team Related Versions: - MW-1.25-release (Backlog) - MW-1.24-release (Backlog) - MW-1.23-release (Backlog) - MW-1.26-release (Backlog) - MW-1.27-release (Backlog) - MW-1.27-release-notes CVE ID: CVE-2015-8005 CVE Type: CWE-201 Description Issue Description: When using ImageMagick as an image scaler, MediaWiki’s parameter causes ImageMagick to embed a metadata field named “Thumb.URI” in the output image, conforming to the “freedesktop.org Thumbnail Managing Standard”. This metadata includes local file paths, which may expose sensitive installation information if the thumbnail image is publicly accessible. Affected Versions: - MediaWiki 1.23 and above - MediaWiki 1.24 and above - MediaWiki 1.25 and above - MediaWiki 1.26 and above - MediaWiki 1.27 and above Fix Information: - A fix patch was submitted: T108616_00.patch - The patch was reviewed and merged via Gerrit. - The fix has been deployed across multiple MediaWiki versions. Related Discussions Actions and Recommendations: - Use the command-line parameter to remove the metadata field. - Discussions included potential follow-up work, such as removing other thumbnail metadata or configuring Thumb::URI to point to the actual public URL of the original image. Impact and Follow-up Related Links and Tracking: - Gerrit Pull Request - Related Task Tracking - There are reports regarding compatibility with GraphicsMagick; users are advised to use the latest version.

Goal Reached Thanks to every supporter — we hit 100%!

MediaWiki CVE-2015-8005 Local Path Disclosure via ImageMagick Thumbnail Metadata