CVE-2026-58025

CriticalCVSS 9.8

Published: 01/07/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

Deserialization of untrusted data vulnerability in MediaWiki. The issue is present in WikiImporter.php, WikiRevision.php, and LogEntryBase.php files. Affects versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9.

Risk Assessment

An attacker can remotely execute arbitrary code or gain unauthorized access by sending crafted data for deserialization.

Recommendation

Immediately update MediaWiki to version 1.46.0, 1.45.4, 1.44.6, or 1.43.9 depending on your branch.

Original NVD description (English source)

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.