The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks.
| Software | From | Fixed in |
|---|---|---|
| mediawiki / mediawiki | 1.24.2 | 1.24.2.x |
| mediawiki / mediawiki | 1.24.3 | 1.24.3.x |
| mediawiki / mediawiki | - | 1.23.10.x |
| mediawiki / mediawiki | 1.24.0 | 1.24.0.x |
| mediawiki / mediawiki | 1.24.1 | 1.24.1.x |
| mediawiki / mediawiki | 1.25.2 | 1.25.2.x |
| mediawiki / mediawiki | 1.25.1 | 1.25.1.x |
| mediawiki / mediawiki | 1.25.0 | 1.25.0.x |