CVE-2010-1190: thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as img_auth.php, do...

Security readout for executives and security teams

CVE-2010-1190 is a privacy bypass in older MediaWiki. Sites that tried to protect uploaded images could still expose scaled thumbnail versions through thumb.php. The business risk is unauthorized viewing of private images, not server takeover based on the supplied evidence. Exposure is most likely on legacy MediaWiki installations earlier than 1.15.2 that store private images and use MediaWiki access-restriction mechanisms such as img_auth.php. Public-only wikis or systems already upgraded are less likely to be affected. Prioritize remediation where old MediaWiki systems contain sensitive, private, or customer images. This is not evidenced as active exploitation, but it can undermine confidentiality controls that leadership may assume are working. Mitigation focus: Upgrade MediaWiki to 1.15.2 or later, or apply vendor distribution security updates.; Check Debian, SUSE, or upstream MediaWiki advisories for package-specific remediation guidance.; Review whether private image handling still depends on legacy thumb.php behavior..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.