Summary
Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, um Informationen offenzulegen, um beliebigen Programmcode auszuführen, und um einen Cross-Site Scripting Angriff durchzuführen.
Product
MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.
Vulnerabilities 13
-
Medium 5.9CVE-2026-58025 Public exploit
Remote Code Execution via Unsafe Deserialization in LogItem Import
Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects Me…
-
Medium 5.3
QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4,…
-
Medium 5.3
Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAcco…
-
Medium 5.3
SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects Synta…
-
Medium 5.3
mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki…
-
Medium 5.3
"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6…
-
Medium 5.1
API identification of users on private wikis
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6,…
-
Low 2.1
Users API leaks whether privileged users have their user groups disabled for lack of 2FA
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionM…
-
None 0.0
$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.4…
-
None 0.0
Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, …
-
None 0.0
Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter…
-
None 0.0
Stored XSS through javascript URLs in SVGs generated by EasyTimeline
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files includes/Timeline.Php, scripts/EasyTimeline.Pl. This issue affects …
-
None 0.0CVE-2026-8857 Scanner template
Full RCE using EasyTimeline Extension
A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Revision history
-
#3
Neue Updates von Debian aufgenommen
-
#2
Referenz(en) aufgenommen: EUVD-2026-41014, EUVD-2026-41045, EUVD-2026-41042, EUVD-2026-41039, EUVD-2026-41034, EUVD-2026-41024, EUVD-2026-41023, EUVD-2026-41022, EUVD-2026-41021, EUVD-2026-41018, EUVD-2026-41031, EUVD-2026-41030, EUVD-2026-41029
-
#1
Initiale Fassung
References
-
MediaWiki-announce vom 2026-06-29
https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/message/J52N2ONQO7GP3XR7UIEA5PI7SVZYTBJ7/
-
Debian Security Advisory DSA-6380 vom 2026-07-05
https://security-tracker.debian.org/tracker/DSA-6380-1