Is there a patch available for CVE-2026-58025?

Yes, a patch is available for CVE-2026-58025. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-58025

Q: What is the CVSS score of CVE-2026-58025?

CVE-2026-58025 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41031 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-07-01 wikimedia-foundation

GHSA-28rr-rpqp-g8c8

PHP Deserialization Mediawiki Wikimedia Foundation

5.9

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

PR:H required for import privileges; AC:H for gadget-chain crafting; S:C because PHP deserialization can affect the underlying server beyond the MediaWiki application boundary.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:05 vuln.today

DescriptionCVE.org

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Deserialization of untrusted data in MediaWiki's wiki import subsystem and logging infrastructure exposes installations to PHP object injection, with high integrity impact on affected systems. Specifically, the WikiImporter, WikiRevision, and LogEntryBase components process attacker-controlled serialized data without sufficient validation, allowing a high-privileged authenticated user to trigger unintended object instantiation or code execution paths. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; however, vendor-confirmed patches are available in releases 1.43.9, 1.44.6, 1.45.4, and 1.46.0.

Technical ContextAI

MediaWiki is the PHP-based wiki engine underpinning Wikipedia and tens of thousands of public and private wiki deployments. The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a class of flaw where PHP's object deserialization mechanisms (e.g., unserialize()) process attacker-influenced input without sanitization, enabling PHP Object Injection - a prerequisite for exploiting gadget chains in the loaded codebase. The three implicated files reveal the attack surface: includes/Import/WikiImporter.php orchestrates the parsing and processing of XML wiki export files; includes/Import/WikiRevision.php handles individual revision objects reconstructed from import data; and includes/Logging/LogEntryBase.php is the base class for MediaWiki's structured log system. The CPE (cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:*) confirms all platform variants are affected. The root cause is likely that serialized PHP data embedded in import XML or log entries is passed to an unsafe deserialization function, allowing instantiation of arbitrary PHP objects from the application's class hierarchy.

RemediationAI

Upgrade MediaWiki to the appropriate patched release for your branch: 1.43.9 (for 1.43.x deployments), 1.44.6 (for 1.44.x), 1.45.4 (for 1.45.x), or 1.46.0 (for main/1.46.x), as confirmed by the vendor at https://phabricator.wikimedia.org/T422244. As a compensating control pending upgrade, restrict or revoke the 'import' and 'importupload' user rights in LocalSettings.php using $wgGroupPermissions to ensure only the minimum necessary set of trusted administrators can trigger the WikiImporter code path - this eliminates the most direct attack vector but does not address the LogEntryBase.php path if it is independently exploitable. Disabling the import feature entirely (removing import permissions from all groups) prevents exploitation via the import subsystem with no impact on normal wiki editing, but will block legitimate wiki content migration workflows. Monitor for unexpected deserialization-related PHP errors or unusual import activity in server logs as a detective control.