MediaWiki CVE-2026-58025

Exploitation requires an authenticated MediaWiki account holding high-privilege import permissions - specifically membership in the 'import' or 'importupload' user groups, which are not granted to standard MediaWiki users by default and must be explicitly assigned by a bureaucrat or sysop. The attacker must be able to submit a crafted wiki XML import file (via Special:Import or the API equivalent) that contains malicious serialized PHP data targeting the WikiImporter.php or WikiRevision.php deserialization path, or separately trigger the LogEntryBase.php deserialization path through log manipulation. AC:H indicates a specific gadget chain must be identified and crafted for the target's PHP class environment and extension set - not a trivial precondition. Exploitation is limited by: (1) mandatory high-privilege authentication (PR:H), ruling out unauthenticated or low-privilege scenarios; (2) high attack complexity requiring tailored gadget chain research; (3) the absence of any known public exploit or PoC code at time of analysis. The CVSS vector provides no indication that default-configuration exploitation is possible without at minimum administrator-level access.

The CVSS 4.0 score of 5.9 with vector AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L reflects a vulnerability with meaningful integrity impact but substantially constrained real-world exploitability. The PR:H rating is the dominant risk limiter: exploitation is restricted to users holding high-privilege MediaWiki roles (typically those in the 'import' or 'importupload' groups, which are not granted to ordinary users), greatly narrowing the viable attacker pool to insiders or accounts compromised after authentication. AC:H further constrains the attack, indicating that beyond obtaining credentials, the attacker must develop or obtain a working PHP gadget chain tailored to the target installation's class environment and extensions. The VI:H (High integrity impact) is noteworthy - successful exploitation can meaningfully alter wiki content or application state. Subsequent-system impacts (SC:L/SI:L/SA:L) suggest limited spillover beyond the MediaWiki application itself. No EPSS score was provided in the input data; no KEV listing exists; no public POC has been identified. Despite deserialization vulnerabilities historically being pathways to RCE, the combination of PR:H and AC:H puts this in a 'real but not urgent for most deployments' category - most at risk are multi-tenant wiki farms where admin-level accounts may be less tightly controlled.

A malicious or compromised MediaWiki administrator with import privileges crafts a wiki XML export file containing embedded serialized PHP objects targeting a viable gadget chain within the MediaWiki codebase or its installed PHP dependencies. The attacker uploads this file via Special:Import; WikiImporter.php processes the file and WikiRevision.php reconstructs revision data, triggering deserialization of the malicious payload and allowing the attacker to manipulate application state or achieve code execution on the server. No public exploit code exists at time of analysis, meaning exploitation requires original PHP gadget-chain research against the specific target environment.