Description
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit.
Advisories 1
- WID-SEC-2023-0849 MediaWiki: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · May 19, 2026
References
- https://phabricator.wikimedia.org/T331362
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/898722
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/895774
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/900133
- https://phabricator.wikimedia.org/rECRG920f3c19a84175bcfe93f41ecf9f8cef32730f8e