CVE-2021-39186 - CVE House
Back to Database
Status published Medium CVE-2021-39186

Improper Input Validation in GlobalNewFiles

Vulnerability Description

GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a workaround, one may disallow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39186

Credits & Attribution

No credits recorded in the NVD database.

References

More from miraheze

View All →
CVE-2025-53371
DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs
Critical 9.1
CVE-2025-43861
ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection
Medium 4.4
CVE-2025-32964
ManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions
Medium 4.6
CVE-2025-32956
ManageWiki has SQL injection vulnerability in NamespaceMigrationJob
High 8
CVE-2024-47816
Users can impersonate import requesters if their actor IDs coincide in ImportDump
Medium 6.4

Affected Vendor

Affected Software

GlobalNewFiles
Vulnerable Versions:
< cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d

Timeline

Official Publish: September 1st, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-20

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact