Detections
Analytics
MediaWiki 1.44.x < 1.44.6 Multiple Vulnerabilities
medium Web App Scanning Plugin ID 115323
Synopsis
MediaWiki 1.44.x < 1.44.6 Multiple VulnerabilitiesDescription
According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.43.9, 1.44.x prior to 1.44.6 or 1.45.x prior to 1.45.4. It is, therefore, affected by a number of vulnerabilities as follows.- LogItem insecure deserialization enabling an arbitrary file write and remote code execution (RCE) via crafted XML during log imports. (CVE-2026-58025)
- ApiQueryUsers leaks the status of private user conditions. (CVE-2026-58036)
- User JavaScript is allowed in pretty-print API responses. (CVE-2026-58028)
- Rev-deleted usernames are exposed in author queries. (CVE-2026-58033)
- API error messages with formatversion=1 are treated as text. (CVE-2026-58032)
- Transcluded titles are not correctly restricted to includable titles. (CVE-2026-58026)
- Insufficient restriction of user lookups in ApiUserrights across interwikis. (CVE-2026-58024)
- Insufficient editmyprivateinfo validation when editing private info. (CVE-2026-58029)
- The LogFormatter raw parameter outputs raw HTML. (CVE-2026-58037)
- AbuseFilter exposes hit counts for protected filters in the API. (CVE-2026-58027)
- SyntaxHighlight_GeSHi does not escape linelinks before Pygments processing. (CVE-2026-58030)
- EasyTimeline script injection via TextData. (CVE-2026-8857)
- Timeline generated SVG stored XSS. (CVE-2026-58038)
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to MediaWiki version 1.44.6 or later.See Also
Plugin Details
Severity: Medium
ID: 115323
Type: Version Based
Family: Component Vulnerability
Published: 7/28/2026
Updated: 7/28/2026
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 6.9
Percentile: 96.92
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-58025
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2026-58025
CVSS v4
Risk Factor: Medium
Base Score: 5.9
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L
CVSS Score Source: CVE-2026-58025
Vulnerability Information
CPE: cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 6/30/2026
Reference Information
CVE: CVE-2026-58024, CVE-2026-58025, CVE-2026-58026, CVE-2026-58027, CVE-2026-58028, CVE-2026-58029, CVE-2026-58030, CVE-2026-58032, CVE-2026-58033, CVE-2026-58036, CVE-2026-58037, CVE-2026-58038, CVE-2026-8857
CWE: 200, 287, 502, 79, 862, 94
OWASP: 2010-A1, 2010-A2, 2010-A3, 2010-A4, 2010-A6, 2010-A8, 2013-A1, 2013-A2, 2013-A3, 2013-A4, 2013-A5, 2013-A7, 2013-A9, 2017-A1, 2017-A2, 2017-A5, 2017-A6, 2017-A7, 2017-A8, 2017-A9, 2021-A1, 2021-A3, 2021-A6, 2021-A7, 2021-A8, 2025-A1, 2025-A5, 2025-A6, 2025-A7, 2025-A8
WASC: Cross-Site Scripting, Improper Input Handling, Information Leakage, Insufficient Authentication, Insufficient Authorization, OS Commanding
CAPEC: 114, 115, 116, 13, 151, 169, 194, 209, 22, 224, 242, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 35, 472, 497, 508, 57, 573, 574, 575, 576, 577, 586, 588, 59, 591, 592, 593, 60, 616, 63, 633, 643, 646, 650, 651, 77, 79, 85, 94
DISA STIG: APSC-DV-000460, APSC-DV-002490, APSC-DV-002510, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10, sp800_53-SI-10(5), sp800_53-SI-15
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.2.5, 4.0.2-5.3.3, 4.0.2-5.5.1, 4.0.2-8.3.4
PCI-DSS: 3.2-6.2, 3.2-6.5.1, 3.2-6.5.10, 3.2-6.5.7, 3.2-6.5.8