Which versions of MediaWiki Wikibase are affected by EUVD-2026-90073?

A high-severity deserialization flaw in the MediaWiki Wikibase extension affects deployments running versions 1.43, 1.45, and 1.46 and could allow arbitrary code execution on the wiki host.

How to fix or mitigate EUVD-2026-90073?

Within 24 hours, inventory all MediaWiki instances and confirm which run the Wikibase extension on versions 1.43, 1.45, or 1.46, noting which are internet-facing versus internal-only; tighten Wikibase edit rights so that only a small, vetted set of trusted accounts can submit structured data, apply any interim workarounds published by the MediaWiki/Wikibase maintainers, and enable detailed logging of wiki application and web server activity for anomalous serialized payloads. Within 7 days, disable the Wikibase extension on any affected host where it is not business-critical, and for hosts where it must remain enabled, place them behind network segmentation and restrictive web application firewall rules, rotate credentials and API tokens for accounts with edit permissions, and begin daily review of wiki logs. Within 30 days, monitor the MediaWiki/Wikibase security advisories for a fixed release covering the 1.43, 1.45, and 1.46 branches, schedule a maintenance window to deploy it immediately once available, and if the fix is delayed, re-validate and document the compensating controls as the interim risk posture.

MediaWiki Wikibase EUVD-2026-90073

Q: What is the CVSS score of EUVD-2026-90073?

EUVD-2026-90073 has a CVSS 4.0 base score of 7.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:I/V:C/RE:M/U:Red. EPSS exploitation probability: 0.4%.

| CVE-2026-103441 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-09-30 wikimedia-foundation

GHSA-5j2p-pvv3-qxhp

Deserialization Mediawiki Mediawiki Wikibase Extension

7.2

CVSS 4.0 · Vendor: wikimedia-foundation

Severity by source

Vendor (wikimedia-foundation) PRIMARY

7.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:I/V:C/RE:M/U:Red

vuln.today AI

7.9 HIGH

Network-reachable but requires an authenticated user (PR:L), specific conditions and victim interaction (AC:H/UI:R); deserialization-to-code-execution crosses a trust boundary (S:C) with high C/I and limited availability impact.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

4.0 AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Primary rating from Vendor (wikimedia-foundation).

CVSS VectorVendor: wikimedia-foundation

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Metadata Corrected

Sep 30, 2026 - 17:40 vuln.today

tag: Mediawiki added

Analysis Generated

Sep 30, 2026 - 16:56 vuln.today

CVE Published

Sep 30, 2026 - 15:59 cve.org

HIGH 7.2

DescriptionCVE.org

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files.

This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

AnalysisAI

Authenticated low-privilege users can exploit a deserialization flaw in the MediaWiki Wikibase extension (versions 1.43, 1.45, and 1.46) to potentially execute arbitrary code, but exploitation is gated by high attack complexity, a specific precondition, and victim interaction. The vulnerability (CWE-502) allows untrusted serialized data to be processed, leading to code execution in non-executable files. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated low-privilege account on a MediaWiki instance running the Wikibase extension at version 1.43, 1.45, or 1.46 (PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine-but-gated CWE-502 deserialization flaw in the MediaWiki Wikibase extension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the upstream fix available at Gerrit change Id35bf747e48370e474d9b9444bd7520b24836e8d; a released patched version is not independently confirmed, so monitor the vendor advisory at https://phabricator.wikimedia.org/T435210 for updates. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all MediaWiki instances and confirm which run the Wikibase extension on versions 1.43, 1.45, or 1.46, noting which are internet-facing versus internal-only; tighten Wikibase edit rights so that only a small, vetted set of trusted accounts can submit structured data, apply any interim workarounds published by the MediaWiki/Wikibase maintainers, and enable detailed logging of wiki application and web server activity for anomalous serialized payloads. …

Threat intelligence, references, and detailed analysis are available after sign-in.