Wikipedia user RobinHood70 reported two issues in the chunked
upload API. The API failed to correctly stop adding new chunks to
the upload when the reported size was exceeded (T91203), allowing
a malicious users to upload add an infinite number of chunks for a
single file upload. Additionally, a malicious user could upload
chunks of 1 byte for very large files, potentially creating a very
large number of files on the server's filesystem (T91205).
Internal review discovered that it is not possible to throttle file
uploads.
Internal review discovered a missing authorization check when
removing suppression from a revision. This allowed users with the
'viewsuppressed' user right but not the appropriate
'suppressrevision' user right to unsuppress revisions.
Richard Stanway from teamliquid.net reported that thumbnails of PNG
files generated with ImageMagick contained the local file path in
the image metadata.