Is there a patch available for CVE-2026-58037?

Yes, a patch is available for CVE-2026-58037. Update the affected software to the latest version immediately.

MediaWiki CVE-2026-58037

EUVD-2026-41042 NONE

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 wikimedia-foundation

GHSA-c9c4-xmc2-5h6x

PHP XSS Mediawiki Wikimedia Foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

0.0 NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today AI

5.4 MEDIUM

Low-privilege account required to inject payload; victim must actively view log page; scope changes to victim browser with limited session/content impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:02 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Cross-site scripting vulnerabilities across multiple log formatter and language components in MediaWiki allow authenticated low-privilege users to inject malicious JavaScript that executes in the browser of any user who views affected log pages or the SpecialVersion special page. The vulnerability spans seven PHP files covering block, patrol, rename-user, and tag log formatters, the base LogFormatter, the Language class, and SpecialVersion - indicating widespread unsanitized output rendering in administrative and logging interfaces. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the breadth of affected components and the multiple concurrent fix branches (1.43.9, 1.44.6, 1.45.4, 1.46.0) signal a significant audit-driven remediation effort.

Technical ContextAI

MediaWiki (CPE: cpe:2.3:a:wikimedia_foundation:mediawiki:*:*:*:*:*:*:*:*) is a PHP-based wiki platform powering Wikipedia and thousands of other wikis. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-controlled input is reflected into HTML output without adequate encoding or escaping. The affected files are concentrated in the logging subsystem - BlockLogFormatter.php (block/unblock actions), PatrolLogFormatter.php (recent-changes patrol), RenameuserLogFormatter.php (account renames), TagLogFormatter.php (tag changes), and the base LogFormatter.php - alongside Language.php (message/i18n rendering) and SpecialVersion.php (software version display). This distribution suggests that log entry parameters such as usernames, page titles, tag names, or block reasons are being rendered into HTML without sanitization, and that some language message substitution or extension metadata displayed on Special:Version also contains an unsanitized output path.

RemediationAI

Upgrade MediaWiki to one of the patched versions: 1.43.9, 1.44.6, 1.45.4, or 1.46.0, selecting the branch that matches the current deployment. The fix details are tracked at https://phabricator.wikimedia.org/T422995. For deployments that cannot patch immediately, a targeted compensating control is to restrict edit and log-generating permissions (block, patrol, tag, renameuser) to trusted users only, reducing the pool of accounts that could inject malicious log parameters. Additionally, consider restricting access to Special:Log and Special:Version to authenticated trusted users via MediaWiki's permission system ($wgGroupPermissions). Note that restricting log viewing only reduces exposure - it does not eliminate the underlying unsanitized output. No patch version has been independently verified beyond the NVD description data.