MediumFix available
wordpress — security advisory
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
- Products
- wordpress
- Affected versions
- Not specified
- Fixed versions
- 5.0.1+dfsg1-1
- CVEs
- CVE-2018-20149
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 00:29 UTC · Revision 1
Source evidence
In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.
osv:DEBIAN-CVE-2018-20149
wordpress
Fixed versions: 5.0.1+dfsg1-1
wordpress
Fixed versions: 5.0.1+dfsg1-1
wordpress
Fixed versions: 5.0.1+dfsg1-1
Complete source record
{
"id": "861d68d29477c061e9219dfff1393a2cd99494eaeef8141969f303785ab0ba7a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2018-20149",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2018-20149",
"summary": "In WordPress before 4.9.9 and 5.x before 5.0.1, when the Apache HTTP Server is used, authors could upload crafted files that bypass intended MIME type restrictions, leading to XSS, as demonstrated by a .jpg file without JPEG data.",
"evidence": "osv:DEBIAN-CVE-2018-20149",
"products": [
{
"name": {
"value": "wordpress",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.0.1+dfsg1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.0.1+dfsg1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "wordpress",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.0.1+dfsg1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2018-20149",
"aliases": [
"DEBIAN-CVE-2018-20149"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.1+dfsg1-1"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/debian/wordpress?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-20149.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.1+dfsg1-1"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/debian/wordpress?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-20149.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.1+dfsg1-1"
}
]
}
],
"package": {
"name": "wordpress",
"purl": "pkg:deb/debian/wordpress?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-20149.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T18:03:20.998754351Z",
"provider": "osv",
"upstream": [
"CVE-2018-20149"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2018-20149"
]
},
"related_cves": [
{
"value": "CVE-2018-20149",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 421243,
"published_at": "2018-12-14T20:29:00.437+00:00"
}