Is there a patch available for EUVD-2026-41018?

Yes, a patch is available for EUVD-2026-41018. Update the affected software to the latest version immediately.

SyntaxHighlight GeSHi EUVD-2026-41018

Q: What is the CVSS score of EUVD-2026-41018?

EUVD-2026-41018 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-58030 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-01 wikimedia-foundation

GHSA-vmx6-3fp5-595p

PHP XSS Syntaxhighlight Geshi Wikimedia Foundation

5.3

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network XSS requiring low-privilege auth; victim must load page (UI:R); scope changes to victim browser; minor confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 17:01 EUVD

Analysis Generated

Jul 01, 2026 - 16:03 vuln.today

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi.

This vulnerability is associated with program files includes/SyntaxHighlight.Php.

This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

AnalysisAI

Cross-site scripting in the Wikimedia Foundation SyntaxHighlight_GeSHi MediaWiki extension allows authenticated users to inject unsanitized input via the syntax highlighting interface, with malicious script executing in victims' browsers upon page view. The flaw originates in includes/SyntaxHighlight.php and affects all versions prior to branch-specific fixes at 1.46.0, 1.45.4, 1.44.6, and 1.43.9. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 5.3 (Medium) reflects limited confidentiality impact scoped to the vulnerable system.

Technical ContextAI

SyntaxHighlight_GeSHi is a MediaWiki extension wrapping the GeSHi (Generic Syntax Highlighter) PHP library to render syntax-colored code blocks on wiki pages. The vulnerability resides in includes/SyntaxHighlight.php and is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that user-supplied input is incorporated into page output without sufficient sanitization or encoding. MediaWiki extensions execute in the PHP layer and render HTML that is then served to downstream browser clients, making any unescaped output a viable XSS vector. The affected CPE is cpe:2.3:a:wikimedia_foundation:syntaxhighlight_geshi:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade SyntaxHighlight_GeSHi to the branch-appropriate patched release: 1.46.0 (for MediaWiki 1.46 deployments), 1.45.4 (for 1.45), 1.44.6 (for 1.44), or 1.43.9 (for 1.43). Patch details are tracked at https://phabricator.wikimedia.org/T427167. If an immediate upgrade is not feasible, a compensating control is to restrict wiki editing permissions so that only highly trusted users can create or edit pages containing syntax-highlighted code blocks - this reduces the attacker pool but does not eliminate the vulnerability and may limit wiki functionality. Disabling the SyntaxHighlight_GeSHi extension entirely via LocalSettings.php ($wgAutoloadExtensions or wfLoadExtension removal) eliminates the attack surface at the cost of losing all syntax highlighting capability.