By vendor

Mediawiki vulnerabilities

Known CVEs affecting Mediawiki products, prioritized by severity, with SEC.co remediation and detection guidance.

22 published vulnerabilities

• CVE-2026-13706HIGH 8.8

  A flaw in Wikimedia Foundation's UrlShortener component fails to properly validate user input, allowing authenticated users to cause significant harm. An attacker with login credentials can exploit this weakness to read sensitive data, alter information, or disrupt service availability. The vulnerability resides in the UrlShortenerUtils.php file and affects MediaWiki deployments.

• CVE-2026-8857HIGH 8.8

  A code injection vulnerability exists in MediaWiki's timeline functionality that allows authenticated users to execute arbitrary code on the server. The flaw resides in components responsible for processing timeline data (scripts/EasyTimeline.Pl and includes/Timeline.Php). An attacker with valid login credentials can inject malicious code that will be executed with server privileges, potentially compromising the entire wiki installation. This is a post-authentication attack, meaning the attacker must already have a user account on the target MediaWiki instance.

• CVE-2026-13707HIGH 7.6

  A session fixation vulnerability has been identified in Wikimedia Foundation's OAuth implementation that allows an attacker to hijack user sessions under specific conditions. Session fixation occurs when an attacker forces a user to use a known session identifier, then exploits that identifier to gain unauthorized access to the user's account. This vulnerability requires the attacker to have some level of access and the user to interact with a malicious link, but once successful, grants the attacker full access to the compromised account's permissions and data.

• CVE-2026-58036HIGH 7.5

  MediaWiki has a vulnerability that allows unauthorized users to access sensitive information through its user query API endpoints. An attacker on the network can exploit this without needing credentials or user interaction, potentially exposing user data that should remain private. The issue stems from insufficient access controls in the components that handle user enumeration and permission checking.

• CVE-2026-58027MEDIUM 6.5

  A Wikimedia Foundation AbuseFilter component is exposing sensitive information that should be restricted to authorized users. The vulnerability requires an authenticated user to trigger, and affects the API filter query functionality. While the issue doesn't allow attackers to modify data or disrupt service, the confidentiality impact is significant—affected versions leak information through the includes/Api/QueryAbuseFilters.Php file that authenticated users shouldn't access.

• CVE-2026-58029MEDIUM 6.5

  A vulnerability in MediaWiki's authentication handling allows attackers to compromise user account security. The flaw resides in how the software processes authentication-related API calls and account linking operations. An attacker can exploit this without authentication or user interaction to gain unauthorized access to user accounts or modify account credentials, though the vulnerability does not enable full system compromise or data destruction.

• CVE-2026-58033MEDIUM 6.5

  MediaWiki contains a vulnerability that can expose sensitive information to unauthorized users. The issue exists in the InfoAction component and requires user interaction to trigger. An attacker cannot exploit this remotely without the target user taking an action (such as clicking a link), but once triggered, the vulnerability can leak confidential data that should remain protected.

• CVE-2026-58518MEDIUM 6.3

  A cross-site request forgery (CSRF) vulnerability exists in the Mediawiki RedirectManager Extension. This flaw allows an attacker to trick a logged-in user into performing unintended actions on a Mediawiki instance without the user's knowledge or consent. The vulnerability affects versions before 1.3.3 and can result in unauthorized changes to redirects or other modifications depending on the attacker's objectives and the target user's permissions.

• CVE-2026-14358MEDIUM 6.1

  The Wikimedia Foundation's MediaWiki Charts Extension contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. An attacker can craft a specially designed chart parameter or input that, when processed by the extension, executes arbitrary JavaScript in the browsers of users viewing that content. This requires user interaction—specifically, a user must view the affected page—but does not require authentication. The vulnerability affects multiple version branches of the Charts Extension and has been patched in versions 1.43.9, 1.44.6, and 1.45.4.

• CVE-2026-58030MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's SyntaxHighlight_GeSHi extension, which is used to display colored code syntax highlighting on MediaWiki installations. The flaw allows an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper sanitization of user input in the SyntaxHighlight.php file before it is rendered in HTML. An attacker would need to trick a user into visiting a malicious wiki page or clicking a crafted link, but once triggered, the injected script executes in the victim's browser within the context of the MediaWiki site. This could allow theft of session cookies, credential harvesting, defacement, or redirection to malicious sites.

• CVE-2026-58032MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in MediaWiki's JavaScript API module that can allow attackers to inject malicious code into web pages viewed by other users. An attacker would need to trick a user into clicking a link or visiting a malicious page, but once executed, the injected script runs in the victim's browser with the permissions of the legitimate MediaWiki site. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

• CVE-2026-58037MEDIUM 6.1

  MediaWiki contains a cross-site scripting (XSS) vulnerability in multiple logging and language components. An attacker can inject malicious scripts into log entries or language-related output that execute in the browsers of users viewing those pages, potentially stealing session tokens, performing actions on behalf of logged-in users, or redirecting them to malicious sites. User interaction is required—the victim must view a page containing the injected payload—but no special permissions are needed to exploit this flaw.

• CVE-2026-58038MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's timeline component that allows attackers to inject malicious scripts into web pages. The flaw stems from improper validation of user input during page generation, affecting the Timeline.php file and EasyTimeline.pl script. An attacker can craft a malicious timeline input that, when rendered in a victim's browser, executes arbitrary JavaScript in the context of the wiki site. This requires user interaction—specifically, a victim must view or interact with a page containing the malicious timeline—but does not require authentication to exploit.

• CVE-2026-58520MEDIUM 6.1

  A vulnerability in Mediawiki's UrlShortener Extension allows attackers to craft malicious URLs that redirect users to untrusted websites. When a user visits a shortened link generated by the extension, they may be sent to a phishing site, malware distribution point, or other malicious destination without clear warning. The vulnerability affects versions before 1.43.9, 1.44.6, and 1.45.4.

• CVE-2026-58024MEDIUM 5.7

  A MediaWiki vulnerability allows authenticated users to access sensitive information they shouldn't be able to see. The flaw is in the user rights API component and requires an attacker to be logged in and interact with a user interface element. While the exposure is limited to confidential data (no data modification or system disruption), it represents a meaningful privacy and compliance risk because sensitive administrative or user information could be leaked to unauthorized individuals.

• CVE-2026-58026MEDIUM 5.7

  A vulnerability in MediaWiki allows authenticated users to view sensitive information they shouldn't have access to through a flaw in the parser component. An attacker needs a valid login and user interaction to exploit this, limiting the attack surface but still representing a meaningful information disclosure risk in environments where many users have accounts.

• CVE-2026-58028MEDIUM 5.4

  A cross-site scripting (XSS) vulnerability exists in Wikimedia MediaWiki and CentralAuth that allows authenticated users to inject malicious scripts into web pages. An attacker with login credentials can craft input that, when viewed by other users, executes arbitrary JavaScript in their browsers. This could enable session hijacking, credential theft, or defacement depending on the victim's permissions. The vulnerability spans multiple API and rendering functions within the codebase.

• CVE-2026-58031MEDIUM 5.4

  A cross-site scripting (XSS) vulnerability exists in MediaWiki's API Sandbox interface. An authenticated user can inject malicious scripts that execute in another user's browser when they interact with the sandbox feature. The scripts run in the context of the MediaWiki site, allowing the attacker to steal session tokens, perform actions on behalf of the victim, or redirect them to malicious sites. This requires both user authentication and victim interaction, limiting its scope but still posing a meaningful risk to collaborative wiki environments.

• CVE-2026-58519MEDIUM 5.4

  The Mediawiki Cargo Extension contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. Once injected, these scripts execute in the browsers of other users who view the affected content, potentially compromising their sessions, stealing credentials, or performing unauthorized actions on their behalf. The vulnerability stems from insufficient input sanitization during web page generation.

• CVE-2026-58034MEDIUM 4.8

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's CheckUser extension for MediaWiki. The flaw is located in a Vue component responsible for blocking connected temporary accounts. An authenticated administrator with high privileges can craft malicious input that executes unintended JavaScript in the browsers of other users viewing the affected page, potentially leading to session hijacking or credential theft.

• CVE-2026-58035MEDIUM 4.8

  MediaWiki contains a cross-site scripting (XSS) vulnerability in its Special:Block page interface that allows an authenticated user with administrative privileges to inject malicious scripts. When a victim visits the affected page after the attacker has crafted a malicious block, the injected code executes in the victim's browser in the context of the wiki. This is a reflected or stored XSS issue depending on how the input flows through the Special Block feature, and it requires both high-privilege attacker account and user interaction to successfully exploit.

• CVE-2026-58517MEDIUM 4.3

  A flaw in MediaWiki's WikiLambda extension allows authenticated users to bypass intended access controls by improperly handling input terminators. An attacker with login credentials could potentially manipulate their permissions or perform actions beyond their assigned role, though the vulnerability requires authentication and does not lead to data disclosure or system unavailability.