MediaWiki (< 1.43.9, < 1.44.6, < 1.45.4, < 1.46.0)

MediaWiki is vulnerable to remote code execution (CVE-2026-58025) via insecure PHP deserialization within the LogEntryBase::extractParams method, allowing authenticated sysop users to execute arbitrary code through malicious XML imports.