CVE-2014-1686 -- Information disclosure: webserver source path in Mediawiki 1.18.0 When a user create a new file (eg: image) with a name containing *, it leads to webserver file path disclosure, after having uploaded the file, when thumbail creation occurs. I did not succeed in obtained remote shell code execution, but this may be a vulnerable path. Counter-measure: refuse creation of file containing a * backported the patch in 1.19 and 1.20 Note, permissions when creating thumbnails can have the same outcome. https://www.owasp.org/index.php/Information_Leakage