Skip to content
OpenAdvisories
High WID-SEC-2026-3693 12 CVEs

MediaWiki Extensions: Mehrere Schwachstellen

Published Sep 30, 2026 · Updated Sep 30, 2026 · de-DE

Platform: Linux Platform: macOS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MediaWiki Extensions ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen sowie Daten zu manipulieren oder offenzulegen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 12

  • High 7.4
    CVE-2026-103446 Public exploit

    WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

    Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

    The Wikimedia Foundation MediaWiki WikiLambda extension Web / CMS
  • High 7.2
    CVE-2026-103441 Public exploit

    Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing

    Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Wikibase extension Web / CMS
  • High 7.2
    CVE-2026-103442 Public exploit

    MergeAccount PHP object injection via session-key substitution

    External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki CentralAuth extension Web / CMS
  • Low 1.2
    CVE-2026-103440 Public exploit

    pagetriagelist discloses suppressed reviewer usernames

    Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki PageTriage extension Web / CMS
  • Low 1.2
    CVE-2026-103445 Public exploit

    Stored XSS through PageForms #autoedit redirect links

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Page_Forms extension Web / CMS
  • Low 1.2
    CVE-2026-103585 Public exploit

    attacker-controlled javascript license URL via XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki MediaSearch extension Web / CMS
  • Low 1.1
    CVE-2026-103437 Public exploit

    ReadingLists imported metadata permits JavaScript URL XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

    The Wikimedia Foundation MediaWiki ReadingLists extension Web / CMS
  • Low 1.1
    CVE-2026-103443

    API permits session-seeded javascript URL XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Collection (Book) extension allows XSS Targeting Non-Script Elements. This issue affects MediaWiki Collection (Book) extension: 1…

    The Wikimedia Foundation MediaWiki Collection (Book) extension Web / CMS
  • Low 1.1
    CVE-2026-103444

    Stored XSS through system messages in WikiForum

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki WikiForum extension allows Stored XSS. This issue affects MediaWiki WikiForum extension: master.

    The Wikimedia Foundation MediaWiki WikiForum extension Web / CMS
  • Low 1.1
    CVE-2026-103584 Public exploit

    attacker-controlled javascript license URL via XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, …

    The Wikimedia Foundation MediaWiki CommonsMetadata extension Web / CMS
  • Low 0.3
    CVE-2026-103438

    Various rawParams() and escaped() updates to prevent XSS in Wikistories extension

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Wikistories extension Web / CMS
  • Low 0.3
    CVE-2026-103439

    Various rawParams() and escaped() updates to prevent XSS in Wikibase extension

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Wikbase extension Web / CMS

Revision history

  1. #1

    Initiale Fassung

References