Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.9, 1.44.x prior to 1.44.6 or 1.45.x prior to 1.45.4. It is, therefore, affected by a number of vulnerabilities as follows.

- LogItem insecure deserialization enabling an arbitrary file write and remote code execution (RCE) via crafted XML during log imports. (CVE-2026-58025)

- ApiQueryUsers leaks the status of private user conditions. (CVE-2026-58036)

- User JavaScript is allowed in pretty-print API responses. (CVE-2026-58028)

- Rev-deleted usernames are exposed in author queries. (CVE-2026-58033)

- API error messages with formatversion=1 are treated as text. (CVE-2026-58032)

- Transcluded titles are not correctly restricted to includable titles. (CVE-2026-58026)

- Insufficient restriction of user lookups in ApiUserrights across interwikis. (CVE-2026-58024)

- Insufficient editmyprivateinfo validation when editing private info. (CVE-2026-58029)

- The LogFormatter raw parameter outputs raw HTML. (CVE-2026-58037)

- AbuseFilter exposes hit counts for protected filters in the API. (CVE-2026-58027)

- SyntaxHighlight_GeSHi does not escape linelinks before Pygments processing. (CVE-2026-58030)

- EasyTimeline script injection via TextData. (CVE-2026-8857)

- Timeline generated SVG stored XSS. (CVE-2026-58038)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6380 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6380-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     July 05, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : mediawiki     CVE ID         : CVE-2026-58024 CVE-2026-58025 CVE-2026-58026 CVE-2026-58027                      CVE-2026-58028 CVE-2026-58029 CVE-2026-58030 CVE-2026-58032                      CVE-2026-58033 CVE-2026-58037

    Multiple security issues were discovered in MediaWiki, a website engine     for collaborative work, which could result in information disclosure,     code execution via unsafe deserialisation or cross-site scripting.

    For the stable distribution (trixie), these problems have been fixed in     version 1:1.43.9+dfsg-1~deb13u1.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation     AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This     issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. (CVE-2026-58027)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115324	MediaWiki 1.45.x < 1.45.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115323	MediaWiki 1.44.x < 1.44.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115322	MediaWiki < 1.43.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
325132	Debian dsa-6380 : mediawiki - security update	Nessus	Debian Local Security Checks	Local	medium
324028	Linux Distros Unpatched Vulnerability : CVE-2026-58027	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-58027

medium

Tenable Plugins

medium

medium

medium

medium

medium