Wikibase: Remote Code Execution via Object Injection (CVE-2026-103441)
An object injection vulnerability in the Wikibase action=parse API enables attackers with low-privilege access to achieve remote code execution via serialized PHP entities.
CVE search metadata
CVE search record: CVE-2026-103441. EPSS: 0.28%. KEV: no. Product: Wikibase Repository. Brief: Wikibase: Remote Code Execution via Object Injection (CVE-2026-103441). Brief link: https://feed.craftedsignal.io/briefs/2026-10-wikibase-rce/
Triage facts
Revision 1- Applicability
- Wikibase Repository
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 23, 17:43 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B2Likely
CVE-2026-103441 is an object injection vulnerability affecting the Wikibase Repository action=parse API. The flaw stems from the API accepting PHP-serialized entities without sufficient validation. This allows attackers to trigger a Smarty destructor that performs unauthorized file operations. In configurations where PHP gadget chains are present, this primitive can be leveraged to achieve remote code execution. The vulnerability requires a low-privilege account to perform the injection via the request body.
Impact
Successful exploitation allows for remote code execution under the context of the web server user. The vulnerability has been assigned a CVSS score of 8.7 (High).
Recommendation
- Prioritize identification of Wikibase installations within the environment.
- Audit web application logs for POST requests to api.php targeting action=parse that contain serialized PHP structures.
- Apply patches released via the official Wikibase Gerrit repository to remediate the API handling of serialized objects.
Immediate actions
Inventory all public-facing Wikibase instances
Threat Hunt
Hunt for suspicious POST requests to api.php containing serialized PHP data structures
Data: Web server access logs (cs-method, cs-uri-stem, cs-uri-query, request_body)
Mitigations
Apply security patches from Wikibase Gerrit repository
CVE-2026-103441