CVE-2014-1686 -- Information disclosure: webserver source path in
Mediawiki 1.18.0

When a user create a new file (eg: image) with a name containing *, it
leads to webserver file path disclosure, after having uploaded the file,
when thumbail creation occurs.

I did not succeed in obtained remote shell code execution, but this may
be a vulnerable path.


Counter-measure: refuse creation of file containing a *
backported the patch in 1.19 and 1.20
Note, permissions when creating thumbnails can have the same outcome.

https://www.owasp.org/index.php/Information_Leakage