CVE-2026-103446

CVE-2026-103446: Anonymous WikiLambda fragment execution Reporter: Marco Paciaroni BomboBombone. The abstractwikirunfragment API did not check the permission required for caller-supplied unsaved fragments. Anonymous requests could therefore send native implementations to the configured WikiLambda...

CVE-2026-102973

CVE-2026-102973: API email authorization hook bypass Reporter: Marco Paciaroni BomboBombone. MediaWiki's action=emailuser API path did not invoke the EmailUserAuthorizeSend hook. When an extension or site policy used that hook to deny a sender, the web form enforced the denial while the API path...

MediaWiki EasyTimeline - Code Injection RCE

MediaWiki EasyTimeline Timeline extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted block can inject ploticus 'proc getdata' a...

cve-2020-29007

CVEID : CVE-2020-29007 Name of the affected products and versions : Mediawiki Score all versions up to 0.3.0 Problem type : CWE-96: Improper Neutralization of Directives in Statically Saved Code ‘Static Code Injection’ Summary Score is a Mediawiki extension which generates musical notation based ...

CVE-2017-8809_MediaWiki_RFD

CVE-2017-8809 - RFDReflected File Download for MediaWiki A remote user can create a specially crafted URL for the target site that, when loaded by the target user, will cause the 'api.php' script to download a file containing shell commands CVE-2017-8809. The file will be served by the target sit...

mediawiki-CVE-2026-100382

Lab reproduction - CVE-2026-100382 ExternalData OS command injection What this lab is MediaWiki 1.43 official image, SQLite + ExternalData3.6.1 last vulnerable, mounted read-only from ../mediawiki-extensions-ExternalData. Loopback only: published on 127.0.0.1:$HOSTPORT default 8080. Anonymous...

CVE-2026-58025

CVE-2026-58025 — MediaWiki PHP Deserialization RCE via Log Entry Import WikiImporter → LogEntryBase::extractParams → unserialize user-controlled logparams → RCE Overview CVE-2026-58025 is a critical CVSS 9.8 deserialization of untrusted data vulnerability in MediaWiki Wikimedia Foundation. The...

CVE-2026-102975

CVE-2026-102975: RevisionDelete API unsuppression authorization bypass Reporter: Marco Paciaroni BomboBombone. MediaWiki's action=revisiondelete accepted suppress=no without checking suppressrevision. A caller with viewsuppressed and a type-specific management right could remove the restricted bi...

CVE-2026-102971

CVE-2026-102971: hidden revision author ID disclosure Reporter: Marco Paciaroni BomboBombone. MediaWiki's RESTBase-compatible revision response could include the numeric user ID of an author whose name had been hidden. The response still set usertext to null and marked the author as hidden, but t...

CVE-2026-126567

Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped nativeresult and scoreset output. Attackers can store markup in a Text property or subobject...

CVE-2026-126566

Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection that checks protection changes against the page's latest revision author. Editors can add set:Is edit protected=false to a transcluded template, removing...

CVE-2026-126565

Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInterpreter classes, which re-expand concepts without memoization or an expansion budget. Users with page-edit rights can build acyclic chains of Concept: pages...

CVE-2026-126564

Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormattedSubject that renders property label segments after a literal as unescaped markup. Users with page-edit rights can set a preferred property label containing an img onerror...

CVE-2026-126561

Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the edit-protection right to lock pages by adding an Is edit protected annotation. Attackers can add Is edit protected::true to pages or set it in widely transcluded templates, so the...

CVE-2026-126562

Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescriptionInterpreter that only detects directly self-referencing concepts. Users with page-edit rights can create mutually referencing concept pages, causing concept page views,...

CVE-2026-126563

Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat, which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout...

CVE-2026-126559

Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles that allows users with the smw-schemaedit right to inject markup. Attackers can save FACETEDSEARCHPROFILESCHEMA profile keys or labels that break out of option elements, executin...

CVE-2026-126560

Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integration that initialises author-written smw-datatable tables unchanged. Users with page-edit rights can add HTML entity-encoded markup in data-search or data-filter cell attributes,...

CVE-2026-126566 Semantic MediaWiki 7.3.1 before 7.4.1 Incorrect Authorization via Edit Protection Annotations

Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userMayChangeProtection that checks protection changes against the page's latest revision author. Editors can add set:Is edit protected=false to a transcluded template, removing...

CVE-2026-126567

Semantic MediaWiki versions 3.0.0 before 7.4.1 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the Special:Ask page when using the ElasticStore backend. The flaw is caused by the application failing to escape native_result and score_set outputs. An attacker with edit ri...