MediaWiki TemplateSandbox EUVD-2026-89034

The affected component is the MediaWiki TemplateSandbox extension specifically, so the target wiki must have this optional extension installed and enabled - a default MediaWiki core installation is not affected. Vulnerable versions are all releases before 1.46.1, 1.45.5, and 1.43.10; applying any of those fixed releases removes exposure. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is required and the attack is network-reachable, but the primary limiting factor is the presence of the TemplateSandbox extension rather than any special configuration; confirm with the Wikimedia advisory whether anonymous access alone is sufficient.

Signals are mixed and point to a serious-but-not-yet-active issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality and integrity impact (9.1, CRITICAL), and SSVC reinforces this with Automatable:yes and Technical Impact:total. However, the exploitation-pressure signals are low: EPSS is only 0.15% (3rd percentile), SSVC Exploitation status is 'none', this CVE is NOT in CISA KEV, and no public POC is identified. The underlying weakness is a missing-authorization / ACL-bypass issue (CWE-862), which is consistent with the C:H/I:H/A:N impact profile (data read and modification without destruction of availability). The discrepancy between the high CVSS/total technical impact and the very low EPSS and 'none' exploitation status suggests this is currently a theoretical-but-credible priority rather than an issue under active, widespread attack. One tension worth verifying: the CVSS claims PR:N (fully unauthenticated), yet the practical impact of a TemplateSandbox authorization bypass likely depends on what wiki functionality the attacker can reach - confirm with the Wikimedia advisory whether truly anonymous users can trigger it or whether a basic account is needed.

A remote attacker sends a crafted request to a MediaWiki instance running the vulnerable TemplateSandbox extension, invoking functionality that is not properly constrained by access-control lists. Because the authorization check is missing, the attacker reads or modifies content or template data they should not be permitted to access, without needing valid privileges or user interaction. No public exploit code has been identified at time of analysis, so exploitation would require independent development.