{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amediawikimediawiki1.46.0rc0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*","cpe:2.3:a:mediawiki:mediawiki:1.46.0:rc0:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-58025"},{"cvss":6.1,"id":"CVE-2026-58037"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MediaWiki (\u003c 1.43.9, \u003c 1.44.6, \u003c 1.45.4, \u003c 1.46.0)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","deserialization","mediawiki"],"_cs_type":"advisory","_cs_vendors":["Wikimedia"],"content_html":"\u003cp\u003eCVE-2026-58025 is a critical deserialization vulnerability in MediaWiki affecting versions prior to 1.43.9, 1.44.6, 1.45.4, and 1.46.0. The vulnerability resides in the \u003ccode\u003eLogEntryBase::extractParams()\u003c/code\u003e method, which improperly calls PHP's \u003ccode\u003eunserialize()\u003c/code\u003e function on user-controlled \u003ccode\u003elog_params\u003c/code\u003e data without implementing class restrictions. An attacker possessing 'import' or 'importupload' privileges (typically members of the 'sysop' group) can supply a crafted XML file containing serialized PHP objects via the \u003ccode\u003eSpecial:Import\u003c/code\u003e interface. When MediaWiki processes these log items, it triggers the instantiation of malicious objects, enabling a gadget chain that leads to remote code execution. This issue, tracked under Phabricator T422244, also necessitated a fix for a related information disclosure/injection vulnerability, CVE-2026-58037, regarding raw HTML parameter formatting in log entries. Organizations should immediately update to the patched versions released by the Wikimedia Foundation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to a MediaWiki instance with an account holding 'import' or 'importupload' privileges.\u003c/li\u003e\n\u003cli\u003eAttacker generates a malicious XML export file containing a crafted \u003ccode\u003e\u0026lt;params\u0026gt;\u003c/code\u003e field within a \u003ccode\u003e\u0026lt;logitem\u0026gt;\u003c/code\u003e element.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e\u0026lt;params\u0026gt;\u003c/code\u003e field contains a serialized PHP object payload designed to trigger a known gadget chain.\u003c/li\u003e\n\u003cli\u003eAttacker uploads the malicious XML file via the \u003ccode\u003eSpecial:Import\u003c/code\u003e endpoint (POST \u003ccode\u003e/wiki/Special:Import\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eMediaWiki \u003ccode\u003eWikiImporter\u003c/code\u003e processes the XML and stores the malicious \u003ccode\u003elog_params\u003c/code\u003e payload into the database via \u003ccode\u003eWikiRevision::importLogItem\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSubsequent access to the log entry (e.g., via \u003ccode\u003eRecentChange::parseParams\u003c/code\u003e or database log reading) triggers \u003ccode\u003eLogEntryBase::extractParams\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application executes \u003ccode\u003eunserialize()\u003c/code\u003e on the malicious blob without class validation.\u003c/li\u003e\n\u003cli\u003ePHP instantiates the malicious object, executing the gadget chain and achieving remote code execution as the web server user.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full remote code execution on the underlying server, granting attackers the ability to compromise the MediaWiki application, access sensitive database content, or pivot further into the internal network. Given the high privileges required for the attack (sysop access), the vulnerability provides an escalation path for already-authenticated administrative users to take complete control of the web server.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching MediaWiki instances to versions 1.43.9, 1.44.6, 1.45.4, or 1.46.0 immediately. If patching is not immediately feasible, restrict access to \u003ccode\u003eSpecial:Import\u003c/code\u003e or revoke 'import' and 'importupload' permissions from non-essential accounts. Enable rigorous monitoring of web server logs for POST requests to \u003ccode\u003eSpecial:Import\u003c/code\u003e from non-administrative or anomalous user sessions.\u003c/p\u003e\n","date_modified":"2026-09-06T22:54:20Z","date_published":"2026-09-06T22:54:20Z","id":"https://feed.craftedsignal.io/briefs/2026-09-mediawiki-rce/","summary":"MediaWiki is vulnerable to remote code execution (CVE-2026-58025) via insecure PHP deserialization within the LogEntryBase::extractParams method, allowing authenticated sysop users to execute arbitrary code through malicious XML imports.","title":"MediaWiki Remote Code Execution via PHP Deserialization","url":"https://feed.craftedsignal.io/briefs/2026-09-mediawiki-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:mediawiki:mediawiki:1.46.0:rc0:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}