Is there a patch available for CVE-2026-34094?

Yes, a patch is available for CVE-2026-34094. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-34094

Q: What is the CVSS score of CVE-2026-34094?

CVE-2026-34094 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29108 LOW

Exposure of Resource to Wrong Sphere (CWE-668)

2026-05-11 wikimedia-foundation

GHSA-g863-m67x-whh5

Information Disclosure PHP Mediawiki

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

2.0 LOW

High privilege and complexity required per source vector; only low confidentiality impact with no integrity or availability effect; no scope change as subsequent systems are unaffected.

3.1 AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:59 vuln.today

Patch available

May 11, 2026 - 18:02 EUVD

CVE Published

May 11, 2026 - 16:50 cve.org

LOW 2.0

CVE Published

May 11, 2026 - 16:50 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Page/Article.Php.

This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

AnalysisAI

MediaWiki's article page rendering code in includes/Page/Article.php exposes limited confidential content to unintended users, constituting an information disclosure under CWE-668 (Exposure of Resource to Wrong Sphere). All MediaWiki deployments running versions prior to 1.43.7, 1.44.4, or 1.45.2 are affected, but exploitation is constrained by high privilege requirements, high attack complexity, and specific preconditions. With a CVSS 4.0 score of 2.0, an EPSS of 0.04% (12th percentile), no CISA KEV listing, and SSVC exploitation status of 'none,' this is a low-priority item suitable for routine patching; no public exploit has been identified at time of analysis.

Technical ContextAI

MediaWiki is a PHP-based wiki platform originally developed by the Wikimedia Foundation to power Wikipedia. The vulnerable component, includes/Page/Article.php, is the core PHP class responsible for rendering wiki article pages - handling page content retrieval, revision history, access control checks, and display logic. CWE-668 (Exposure of Resource to Wrong Sphere) indicates that under specific conditions, the Article.php code exposes a resource - likely page content, draft revision data, or access-controlled metadata - to a user or context outside the intended authorization boundary. The affected CPE cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:* covers all platform variants. The CVSS 4.0 vector's AT:P (Attack Prerequisites Present) reinforces that a non-default or uncommon configuration state must be in place for the exposure to occur.

RemediationAI

Upgrade MediaWiki to a fixed release: 1.43.7 for the 1.43.x LTS branch, 1.44.4 for the 1.44.x branch, or 1.45.2 for the 1.45.x branch. The vendor patch is confirmed available per Wikimedia Foundation. Consult the Wikimedia Phabricator task (https://phabricator.wikimedia.org/T416090) and the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-34094) for patch notes and deployment instructions. Given the very low severity (CVSS 4.0: 2.0), low EPSS, and no active exploitation, emergency out-of-band patching is not warranted; administrators should include this in the next scheduled maintenance window. No specific compensating controls have been identified from available data, but ensuring least-privilege access controls are enforced for high-privilege MediaWiki accounts reduces the already-limited attacker surface.