Description
An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | mediawiki/cargo | < 1.35.14 | 1.35.14 | GHSA-rhpm-63w5-79rg |
| Packagist | mediawiki/cargo | >= 1.36.0, < 1.39.6 | 1.39.6 | GHSA-rhpm-63w5-79rg |
| Packagist | mediawiki/cargo | >= 1.40.0, < 1.40.2 | 1.40.2 | GHSA-rhpm-63w5-79rg |
Advisories 1
- WID-SEC-2024-0083 MediaWiki: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Sep 13, 2026