Is there a patch available for CVE-2026-58521?

Yes, a patch is available for CVE-2026-58521. Update the affected software to the latest version immediately.

MediaWiki Cargo CVE-2026-58521

Q: What is the CVSS score of CVE-2026-58521?

CVE-2026-58521 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41102 MEDIUM

SQL Injection (CWE-89)

2026-07-01 wikimedia-foundation

GHSA-9j5g-78q4-mjh2

SQLi Mediawiki Cargo Extension The Wikimedia Foundation

6.9

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-exploitable SQL injection requiring no authentication (PR:N); scope changes to the backend database system (S:C); all impacts remain Low, consistent with CVSS 4.0 signals suggesting constrained table-level access.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 19:02 EUVD

Analysis Generated

Jul 01, 2026 - 18:23 vuln.today

DescriptionCVE.org

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

AnalysisAI

SQL injection in the Wikimedia Foundation's Cargo Extension for MediaWiki exposes all installations running versions prior to 1.43.9, 1.44.6, or 1.45.4 to unauthenticated database manipulation via the Cargo query interface. The flaw stems from improper neutralization of user-controlled input incorporated into SQL statements without adequate parameterization, allowing attackers to read, modify, or partially disrupt data stored in Cargo-managed tables. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 vector confirms low-complexity, network-accessible exploitation requiring no authentication or user interaction.

Technical ContextAI

The Cargo Extension (CPE: cpe:2.3:a:the_wikimedia_foundation:mediawiki_-_cargo_extension:*:*:*:*:*:*:*:*) extends MediaWiki by enabling structured data storage in custom database tables and retrieval via template parser functions such as #cargo_query. CWE-89 (Improper Neutralization of Special Elements in SQL Commands) arises when user-supplied query parameters - such as field selectors, filter conditions, or table identifiers passed through Cargo template syntax - are interpolated into SQL statements without parameterization or sufficient escaping. MediaWiki typically uses the Wikimedia\Rdbms database abstraction layer, which may constrain the scope of injection to Cargo-provisioned tables rather than the full schema, consistent with the all-Low CVSS 4.0 impact ratings. On public wikis, Cargo query templates can be rendered for anonymous visitors, broadening the unauthenticated attack surface significantly.

RemediationAI

Upgrade the Cargo Extension to the patched release for your MediaWiki branch: 1.43.9 for the 1.43.x series, 1.44.6 for the 1.44.x series, or 1.45.4 for the 1.45.x series. The fix is tracked in Gerrit change https://gerrit.wikimedia.org/r/c/1298854 and Phabricator task https://phabricator.wikimedia.org/T428274. If an immediate upgrade is not possible, restrict access to pages and templates invoking #cargo_query and related Cargo functions by tightening MediaWiki group permissions ($wgGroupPermissions) to require at minimum a registered user session before Cargo queries are parsed and executed - this trades wiki functionality for reduced attack surface but does not eliminate risk for authenticated-user exploitation paths. Additionally, consider deploying a WAF rule targeting SQL metacharacter injection in query string parameters as a supplementary control, noting that WAF bypass techniques exist and this is not a substitute for patching.