CVE-2026-30917

High

Published: 10/03/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

The Bucket extension for MediaWiki before version 2.1.1 contains a stored XSS vulnerability. An attacker can inject malicious script into any Bucket table field of PAGE type, which executes when a user views the corresponding Bucket namespace page.

Risk Assessment

The risk involves execution of malicious script in the user's browser, potentially leading to session theft, account takeover, or spreading malicious content within the wiki.

Recommendation

Immediately update the Bucket extension to version 2.1.1 or later, which includes a fix for this vulnerability.

Other vulnerabilities in Bucket

CVE-2025-61766Medium
Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This can result in PHP's call stack limit being exceeded and/or increased memory consumption, potentially leading to denial of service. Version 1.0.0 contains a patch.

Original NVD description (English source)

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to 2.1.1, a stored XSS can be inserted into any Bucket table field that has a PAGE type, which will execute whenever a user views that table's corresponding Bucket namespace page. This vulnerability is fixed in 2.1.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS