CVE-2026-58028: MediaWiki XSS Vulnerability in API and Page Rendering

Technical summary

CVE-2026-58028 is a persistent XSS vulnerability (CWE-79) stemming from improper input neutralization during web page generation. The flaw affects five critical code paths: ApiFormatBase.php and ApiHelp.php (API response handling), Module.php (ResourceLoader), PageDisplayHookHandler.php (page rendering), and PermissionChangeLogFormatter.php (log output). The vulnerability requires an authenticated attacker to supply crafted input, which is then rendered without adequate escaping or sanitization. The scope is changed, meaning the impact extends beyond the vulnerable component to affect other users and systems on the same MediaWiki installation.

Business impact

For organizations running MediaWiki or CentralAuth as internal wikis or collaborative platforms, this vulnerability creates a medium-severity insider threat. Authenticated users—whether employees, contractors, or compromised accounts—can launch attacks against other users without direct administrative access. In multi-tenant or federation scenarios (CentralAuth), the risk amplifies across multiple wikis. Potential consequences include data exfiltration via session tokens, unauthorized access to sensitive wiki content, and reputational damage if public-facing wikis are compromised. The requirement for prior authentication raises the barrier somewhat, but trust relationships within organizations often mean that barrier is lower than external attacks.

Affected systems

MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are vulnerable. CentralAuth is affected by the same version constraints. Any deployment running older releases of either component is at risk. This includes self-hosted MediaWiki instances, Wikipedia-compatible installations, and enterprise knowledge management platforms built on MediaWiki. The vulnerability does not require special configuration; it exists in default installations.

Exploitability

Exploitation requires valid login credentials and user interaction—the attacker must convince or manipulate a victim into clicking a malicious link or visiting a specially crafted page containing the injected payload. The low attack complexity and network accessibility make this a practical risk in environments with many authenticated users. The CVSS score of 5.4 (Medium) reflects the authentication requirement and user interaction constraint, which reduce severity compared to unauthenticated or fully automated attacks. However, in collaborative wiki environments where trust is implicit, social engineering barriers are minimal.

Remediation

Upgrade MediaWiki and CentralAuth to patched versions: 1.46.0, 1.45.4, 1.44.6, or 1.43.9 depending on your release branch. Administrators should identify which branch your deployment is on and apply the corresponding patch. Test the upgrade in a staging environment first, as MediaWiki patches occasionally affect extensions or customizations. If immediate patching is not possible, restrict edit and comment permissions to trusted users only, and implement output encoding at the application or web server level (e.g., Content Security Policy headers) to mitigate script execution.

Patch guidance

Patches are available for four release lines: version 1.46.0 (latest), 1.45.4 (LTS), 1.44.6 (maintenance), and 1.43.9 (legacy support). Determine your current version via Special:Version in the wiki interface or by checking LocalSettings.php. Consult the Wikimedia security advisory for detailed upgrade procedures; backup your wiki database and file system before patching. After upgrade, verify the patch by checking the version number and testing basic API calls and page rendering to confirm functionality. For CentralAuth users, coordinate upgrades across all federated wikis to maintain consistency.

Detection guidance

Monitor API requests (ApiFormatBase, ApiHelp endpoints) and page edit logs for unusual parameter values, especially those containing HTML tags, JavaScript event handlers (onclick, onerror), or script tags. Log formatters and ResourceLoader requests should also be scrutinized. Enable verbose logging for Special:Log entries, particularly PermissionChange logs, and look for entries created by authenticated users with suspicious content. Implement Web Application Firewall rules to block common XSS payloads in POST/GET parameters. Review browser console errors and Content Security Policy violations in web server logs, as these may indicate successful or blocked injection attempts. Check the audit log for edit summaries containing encoded or obfuscated script payloads.

Why prioritize this

Although the CVSS score is Medium (5.4), this vulnerability should be prioritized above that rating for wiki administrators because: (1) it affects a widely deployed platform with high user populations, (2) XSS on collaborative platforms can rapidly spread via user-to-user interaction, (3) wiki content is often indexed by search engines, potentially spreading payloads to external users, and (4) multiple affected code paths increase the surface area. The four-patch release strategy suggests a significant security issue that warranted coordinated disclosure across multiple maintenance branches. Organizations running public or internal wikis should treat this as high-priority within the Medium severity tier.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects: Attack Vector Network (AV:N) because the API and web rendering are accessible remotely; Access Complexity Low (AC:L) because no special conditions are needed; Privileges Required Login (PR:L) which reduces severity significantly; User Interaction Required (UI:R) because a victim must view the crafted content; Scope Changed (S:C) indicating the vulnerability can affect other users and systems. The absence of Availability impact (A:N) means denial of service is not a vector. Had this been unauthenticated, the score would be much higher (likely 7.0+). In practice, security teams should weight this higher internally if their wiki has a large authenticated user base or high-value sensitive content, as the attack chain, while requiring authentication, is realistic in insider-threat scenarios.

Frequently asked questions