CVE-2026-58037: MediaWiki Cross-Site Scripting (XSS) in Log Formatters and Language Components

Technical summary

This XSS vulnerability (CWE-79) spans seven files in MediaWiki's codebase: Language.php, BlockLogFormatter.php, LogFormatter.php, PatrolLogFormatter.php, RenameUserLogFormatter.php, TagLogFormatter.php, and SpecialVersion.php. The vulnerability results from improper sanitization of user-controlled input during web page generation. Attackers can craft inputs that bypass output encoding, allowing arbitrary JavaScript execution in the context of the MediaWiki application. The CVSS 3.1 score of 6.1 (MEDIUM) reflects network accessibility, low attack complexity, and lack of privilege requirements, tempered by the requirement for user interaction and limited impact scope due to same-site restrictions on some attack vectors.

Business impact

Exploitation could compromise user accounts and administrator trust. Attackers may harvest session credentials, perform unauthorized edits or administrative actions, deface pages, or redirect users to phishing or malware distribution sites. For wiki operators, this undermines data integrity and user confidence, especially if logged events or version pages are targets. Organizations relying on MediaWiki for documentation or knowledge management face potential information disclosure or tampering.

Affected systems

All MediaWiki installations before version 1.46.0 are affected. Specific earlier release lines vulnerable include versions before 1.45.4, 1.44.6, and 1.43.9. Organizations running any version in the 1.43.x through 1.45.x series or earlier versions in the main branch must evaluate their patch status immediately.

Exploitability

This vulnerability requires user interaction and network access but no authentication or special privileges. An attacker can craft a malicious log entry or inject payload into a language-dependent output field. When an administrator, moderator, or regular user views the affected page, the script executes in their browser. The attack surface spans logging functionality used frequently by wiki operators, making discovery and exploitation straightforward for motivated attackers. However, browser same-origin policies and content security headers (if properly configured) may provide partial mitigation.

Remediation

Upgrade MediaWiki immediately to a patched version. Verify against your current installation version and apply the smallest applicable patch: version 1.46.0 or later, 1.45.4 or later, 1.44.6 or later, or 1.43.9 or later. After patching, clear browser caches and ensure all users are logged out and back in to avoid serving cached malicious content. Review recent log entries for any suspicious or unusual content that might indicate prior exploitation attempts.

Patch guidance

Consult the Wikimedia Foundation security advisory for your specific version branch. Test patches in a staging environment before production deployment. MediaWiki upgrades should follow standard procedures: backup the database, test the upgrade, review any configuration changes, and validate that extensions remain compatible. For organizations on extended support, verify that your release line is still receiving security updates; end-of-life versions will not receive patches.

Detection guidance

Monitor for suspicious patterns in log tables and version page access logs. Look for script-like syntax or HTML entities (e.g., <script>, <, onerror=) in log entry text, edit summaries, or user rename operations. Use web application firewalls to detect XSS-like payloads in request parameters. Review server and application logs for unusual access to the affected PHP files. If a staging or test instance is compromised, assume the production wiki may also be at risk and review edit and log histories for injected content.

Why prioritize this

Although the CVSS score is MEDIUM (6.1), the vulnerability affects critical administrative and logging functions relied upon by wiki operators daily. The lack of privilege requirements and low attack complexity means opportunistic attackers can exploit this widely. Log entries and version pages are frequently accessed by trusted users, amplifying the potential for credential theft or account compromise. For any public or semi-public MediaWiki instance, this should be treated as a high-priority patch.

Risk score, explained

The CVSS 3.1 score of 6.1 reflects: (1) network-based attack vector requiring no special access; (2) low attack complexity with no race conditions or special setup; (3) no privilege requirement; (4) user interaction required (victim must view the malicious page); (5) changed security scope (the XSS executes in the context of the MediaWiki application, affecting other users and the application itself); (6) low confidentiality impact (session tokens or non-sensitive data may be exfiltrated); (7) low integrity impact (user actions can be forged, but systemic damage is limited); (8) no availability impact. The MEDIUM rating reflects the combination of ease of exploitation offset by user interaction requirements and limited blast radius per incident.

Frequently asked questions