Is there a patch available for CVE-2026-14363?

Yes, a patch is available for CVE-2026-14363. Update the affected software to the latest version immediately.

MediaWiki Cargo Extension CVE-2026-14363

Q: What is the CVSS score of CVE-2026-14363?

CVE-2026-14363 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41127 MEDIUM

SQL Injection (CWE-89)

2026-07-01 wikimedia-foundation

GHSA-cj99-hcr5-53g3

SQLi Red Hat Mediawiki Cargo Extension The Wikimedia Foundation

6.9

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable with no auth (PR:N); scope change justified as database is a separate component affected beyond the web application.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 21:02 EUVD

Analysis Generated

Jul 01, 2026 - 20:18 vuln.today

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

AnalysisAI

SQL injection in the Wikimedia Foundation's MediaWiki Cargo Extension exposes wiki deployments to unauthenticated database read and write operations across all versions prior to 1.43.9, 1.44.6, and 1.45.4. The Cargo extension's core function - accepting user-supplied query parameters to construct database queries - makes this a structurally sensitive attack surface, as improper neutralization of SQL special elements allows crafted input to escape intended query boundaries. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the PR:N/AC:L/AT:N CVSS 4.0 vector confirms exploitation requires no authentication or special preconditions against default-accessible Cargo query endpoints.

Technical ContextAI

The Wikimedia Cargo extension (CPE: cpe:2.3:a:the_wikimedia_foundation:mediawiki_-_cargo_extension:*:*:*:*:*:*:*:*) adds structured data storage and retrieval to MediaWiki wikis, allowing editors to define typed data tables and query them via parser functions like {{#cargo_query:}}. These query parameters are passed through to the underlying relational database (typically MySQL/MariaDB). CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) indicates that user-controlled input reaches SQL query construction without adequate escaping or parameterization, enabling injection of arbitrary SQL clauses. The vulnerability is rooted in how Cargo translates wiki markup query parameters into SQL - a pattern historically prone to injection when sanitization is incomplete. The Gerrit patches at /r/c/mediawiki/extensions/Cargo/+/1279498 and /r/c/mediawiki/extensions/Cargo/+/1269701 represent the upstream fixes reviewed and merged.

RemediationAI

Upgrade the Cargo extension to version 1.43.9, 1.44.6, or 1.45.4 depending on the MediaWiki branch in use - these are the vendor-confirmed fixed releases. The upstream code fixes are documented in Gerrit code reviews at https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1279498 and https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1269701, and the issue is tracked at https://phabricator.wikimedia.org/T422774. As a compensating control prior to patching, restrict access to Cargo query functionality by raising the 'cargo-query' user right to require authentication or a trusted group via LocalSettings.php ($wgGroupPermissions), which limits the exposed attack surface to logged-in users rather than anonymous visitors. Note that restricting by IP allowlist at the web server layer is not sufficient alone if the wiki has public user registration enabled.