Cpe:2.3:a:wikimedia:wikibase:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awikimediawikibase/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 17:43:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWikibase: Remote Code Execution via Object Injection (CVE-2026-103441)https://feed.craftedsignal.io/briefs/2026-10-wikibase-rce/Fri, 23 Oct 2026 17:43:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wikibase-rce/An object injection vulnerability in the Wikibase action=parse API enables attackers with low-privilege access to achieve remote code execution via serialized PHP entities.CVE-2026-103441 is an object injection vulnerability affecting the Wikibase Repository action=parse API. The flaw stems from the API accepting PHP-serialized entities without sufficient validation. This allows attackers to trigger a Smarty destructor that performs unauthorized file operations. In configurations where PHP gadget chains are present, this primitive can be leveraged to achieve remote code execution. The vulnerability requires a low-privilege account to perform the injection via the request body.

Impact

Successful exploitation allows for remote code execution under the context of the web server user. The vulnerability has been assigned a CVSS score of 8.7 (High).

Recommendation

  • Prioritize identification of Wikibase installations within the environment.
  • Audit web application logs for POST requests to api.php targeting action=parse that contain serialized PHP structures.
  • Apply patches released via the official Wikibase Gerrit repository to remediate the API handling of serialized objects.
]]>highadvisory