MediaWiki Remote Code Execution via PHP Deserialization

CVE-2026-58025 is a critical deserialization vulnerability in MediaWiki affecting versions prior to 1.43.9, 1.44.6, 1.45.4, and 1.46.0. The vulnerability resides in the LogEntryBase::extractParams() method, which improperly calls PHP's unserialize() function on user-controlled log_params data without implementing class restrictions. An attacker possessing 'import' or 'importupload' privileges (typically members of the 'sysop' group) can supply a crafted XML file containing serialized PHP objects via the Special:Import interface. When MediaWiki processes these log items, it triggers the instantiation of malicious objects, enabling a gadget chain that leads to remote code execution. This issue, tracked under Phabricator T422244, also necessitated a fix for a related information disclosure/injection vulnerability, CVE-2026-58037, regarding raw HTML parameter formatting in log entries. Organizations should immediately update to the patched versions released by the Wikimedia Foundation.

Attack Chain

1. Attacker authenticates to a MediaWiki instance with an account holding 'import' or 'importupload' privileges.
2. Attacker generates a malicious XML export file containing a crafted <params> field within a <logitem> element.
3. The <params> field contains a serialized PHP object payload designed to trigger a known gadget chain.
4. Attacker uploads the malicious XML file via the Special:Import endpoint (POST /wiki/Special:Import).
5. MediaWiki WikiImporter processes the XML and stores the malicious log_params payload into the database via WikiRevision::importLogItem.
6. Subsequent access to the log entry (e.g., via RecentChange::parseParams or database log reading) triggers LogEntryBase::extractParams.
7. The application executes unserialize() on the malicious blob without class validation.
8. PHP instantiates the malicious object, executing the gadget chain and achieving remote code execution as the web server user.

Impact

Successful exploitation allows for full remote code execution on the underlying server, granting attackers the ability to compromise the MediaWiki application, access sensitive database content, or pivot further into the internal network. Given the high privileges required for the attack (sysop access), the vulnerability provides an escalation path for already-authenticated administrative users to take complete control of the web server.

Recommendation

Prioritize patching MediaWiki instances to versions 1.43.9, 1.44.6, 1.45.4, or 1.46.0 immediately. If patching is not immediately feasible, restrict access to Special:Import or revoke 'import' and 'importupload' permissions from non-essential accounts. Enable rigorous monitoring of web server logs for POST requests to Special:Import from non-administrative or anomalous user sessions.