What is the CVSS score of CVE-2026-0669?

CVE-2026-0669 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Mediawiki are affected by CVE-2026-0669?

CVE-2026-0669 presents notable security risk, a path traversal vulnerability rated CVSS 7.5.. A patch is available.

Is there a public PoC exploit available for CVE-2026-0669?

Yes, a public proof-of-concept exploit is available for CVE-2026-0669. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-0669?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Review file handling controls and restrict upload directories.

Mediawiki CVE-2026-0669

HIGH

Path Traversal (CWE-22)

2026-01-07 c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

Path Traversal Mediawiki Red Hat Css

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 23, 2026 - 18:45 vuln.today

Public exploit code

Patch released

Feb 23, 2026 - 18:45 nvd

Patch available

CVE Published

Jan 07, 2026 - 18:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.

AnalysisAI

The MediaWiki CSS extension in versions 1.39, 1.43, and 1.44 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server. Public exploit code exists for this vulnerability, enabling attackers to access sensitive information outside the intended directory restrictions. A patch is available and should be applied immediately to affected installations.

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects Css. Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.

RemediationAI

A vendor patch is available — apply it immediately. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.