Skip to content
OpenAdvisories
High WID-SEC-2026-2170 7 CVEs

MediaWiki und Extensions: Mehrere Schwachstellen

Published Jul 1, 2026 · Updated Jul 1, 2026 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten, die Authentifizierung zu umgehen oder SQL-Injection-Angriffe durchzuführen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 7

  • Medium 6.9
    CVE-2026-14358

    Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.…

    The Wikimedia Foundation Mediawiki - Charts Extension Web / CMS
  • Medium 6.9
    CVE-2026-14363

    Cargo Extension: SQLi in Special:Drilldown

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Medium 6.9
    CVE-2026-58517

    Blocked users can create and edit WikiLambda objects

    Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This issue affects Mediawiki - WikiLambda Extension: from * before 1.43.9,1.44.6,1.45.4.

    The Wikimedia Foundation MediaWiki WikiLambda extension Web / CMS
  • Medium 6.9
    CVE-2026-58520

    UrlShortener defaults to ineffective validation open to third-party redirects

    URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener Extension: from * before 1.43.9, 1.44.6, 1.45.4.

    The Wikimedia Foundation Mediawiki - UrlShortener Extension Web / CMS
  • Medium 6.9
    CVE-2026-58521

    SQLi in Cargo extension via year range filter

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • None 0.0
    CVE-2026-58031

    Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. Th…

    Wikimedia Foundation MediaWiki mediawiki Web / CMS Ubuntu
  • None 0.0
    CVE-2026-58035

    Stored XSS through a system message in the codex version of Special:Block

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.

    Wikimedia Foundation MediaWiki mediawiki Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References