CVE-2026-103441

CVE-2026-103441: Wikibase serialized entity object injection Reporter: Marco Paciaroni BomboBombone. The public action=parse API accepted PHP-serialized Wikibase entities. Unrestricted object construction could reach a Smarty destructor that unlinks a caller-selected path. Available PHP gadget...