MediaWiki CVE-2026-58037

Exploitation requires a valid MediaWiki account with at least low-level privileges sufficient to perform actions that are recorded by the affected log formatters (block, patrol, tag, rename-user) or to influence content displayed on Special:Version. A second user (the victim) must actively navigate to and view the affected log page or special page in their browser (UI:A per CVSS 4.0 vector). Exploitation is limited by: (1) the need for an authenticated attacker account (PR:L), (2) active victim interaction - passive page loads in background tabs would suffice but the victim must load the page, (3) the victim being a user who can access log pages, which on many wikis is restricted to registered users or patrollers. There is no indication of a default-configuration unauthenticated exploitation path.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N) presents a notable inconsistency: all confidentiality, integrity, and availability metrics - for both the vulnerable system and subsequent systems - are scored as None, which is atypical for a CWE-79 XSS that exploits a victim's browser session. This may reflect a deliberately conservative or placeholder scoring by the reporter, or may indicate a very narrow exploitability path where JavaScript execution does not yield meaningful access to sensitive data. No EPSS score is available, no CISA KEV listing exists, and no public proof-of-concept has been identified, all pointing toward low current exploitation risk. The attack complexity is low and the network vector is confirmed, but the requirement for an authenticated low-privilege actor (PR:L) and active victim interaction (UI:A) meaningfully limits the attack surface compared to unauthenticated reflected XSS. The most realistic concern is privilege escalation through session hijacking if a privileged administrator views a tampered log entry, but this impact is not confirmed by the provided impact metrics. EPSS data is absent - exploitation probability cannot be quantified.

An attacker with a low-privilege MediaWiki account performs an action that generates a log entry processed by one of the affected formatters - for example, triggering a tag change or block action with a crafted payload embedded in a username or reason field. When an administrator later views Special:Log or a related log page, the payload executes in their browser, potentially exfiltrating session cookies or performing privileged wiki actions on their behalf. No public proof-of-concept has been identified at time of analysis.