MediaWiki vulnerabilities

A vulnerability in MediaWiki related to the exposure of sensitive information to unauthorized actors. It affects program files includes/Skin/Skin.Php.

CVE-2026-34091 describes an exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.

CVE-2026-34088 involves the exposure of sensitive information to unauthorized actors in MediaWiki. This affects versions before 1.43.7, 1.44.4, and 1.45.2.

The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.

The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by 'a lot of junk.'

MediaWiki versions before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provide different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.

MediaWiki versions before 1.18.5 and 1.19.x before 1.19.2 allow remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.

MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights.

MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, allowing remote attackers to obtain sensitive information via a parse action to api.php.

MediaWiki versions before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, may allow remote attackers to obtain sensitive information by failing to terminate sessions when a user account is blocked.

ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.

MediaWiki versions before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library. This allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.

The User::matchEditToken function in MediaWiki before version 1.23.12 and 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time, allowing remote attackers to guess the edit token and bypass CSRF protection via a timing attack.

The User::matchEditToken function in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time, allowing remote attackers to guess the edit token and bypass CSRF protection via a timing attack.

The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, allowing remote attackers to guess the watchlist token and bypass CSRF protection via a timing attack.

MediaWiki versions before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, are vulnerable to a denial of service attack. Attackers can exploit a large number of nested entity references in SVG files or XMP metadata in PDF files, leading to CPU and memory consumption.

MediaWiki versions before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allow remote attackers to cause a denial of service via an XML file containing an entity declaration with long replacement text and many references to this entity.

MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password.

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before version 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request.

MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, allowing remote attackers to have unspecified impact via invalid XML.

Deserialization of untrusted data vulnerability in MediaWiki. The issue is present in WikiImporter.php, WikiRevision.php, and LogEntryBase.php files. Affects versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9.

The api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.

The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, making it easier for remote attackers to gain access via a brute-force attack.

A Cross-site Scripting (XSS) vulnerability was found in MediaWiki due to improper input neutralization during page generation. It affects multiple source files including Language.php and various log formatters.

A vulnerability in MediaWiki allows an unauthorized actor to access sensitive information through API and permission management files.

A vulnerability in MediaWiki allows an unauthorized actor to access sensitive information. The issue is located in the includes/Actions/InfoAction.php file.

A cross-site scripting (XSS) vulnerability exists in MediaWiki before versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9 in the file resources/src/mediawiki.Api/index.js. Improper input neutralization during web page generation allows injection of malicious scripts.

A vulnerability in MediaWiki allows unauthorized access to authentication and account management functions. The issue affects API files and special pages responsible for changing, linking, and removing authentication data.

A vulnerability in MediaWiki allows an unauthorized actor to access sensitive information. The issue is located in the includes/Parser/Parser.php file and affects versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9.

A vulnerability in MediaWiki allows an unauthorized actor to access sensitive information via the includes/Api/ApiUserrights.php file. The issue affects versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9.

A Cross-site Scripting (XSS) vulnerability was found in MediaWiki in the program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue. The issue is caused by improper neutralization of input during web page generation.

An XSS vulnerability in MediaWiki exists in the ApiSandboxLayout.Js file, allowing an attacker to inject malicious scripts into a page. The issue affects versions from 1.46.0-rc.0 before 1.46.0.

The GrowthExperiments extension in MediaWiki contains an infinite loop vulnerability that allows leveraging Time-of-Check Time-of-Use (TOCTOU) race conditions. This issue was fixed only on the `master` branch.

The GlobalWatchlist extension in MediaWiki from Wikimedia Foundation is vulnerable to XSS due to improper input neutralization. The issue has been fixed in the master branch and in versions 1.43, 1.44, and 1.45.

The ReportIncident extension in Wikimedia Foundation MediaWiki has an allocation of resources without limits vulnerability, allowing HTTP DoS attacks. The fix is only available on the master branch.

A denial of service vulnerability in MediaWiki 1.2.0 allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.

An issue was discovered in MediaWiki before version 1.35.11 and in versions 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1 that allows bypassing the Bad image list (badFile) using the thumb parameter (Manualthumb) of the File syntax.