FAIL › dossier
mediawiki
VENDOR· dossier confidence 20%
MediaWiki is a widely deployed open-source wiki engine powering Wikipedia and Wikimedia projects. Its 2026 critical zero-day RCE and SQL injection vulnerabilities highlight severe input validation and deserialization flaws in core and extension code.
PROFILE
Categoryopen-source softwareWhat they doMediaWiki is a free and open-source wiki application written in PHP, used to power Wikipedia and other Wikimedia projects.
Websitehttps://www.mediawiki.org ↗
SECURITY POSTURE
The Wikimedia Foundation maintains MediaWiki but has suffered critical zero-day RCE and SQL injection vulnerabilities in 2026, indicating gaps in input validation and deserialization handling.
Notable failures
- CVE-2026-58025 RCE0day
- CVE-2026-14363 SQL injection
- CVE-2026-58521 SQL injection
Patterns: critical zero-day RCE via deserialization; SQL injection in extensions
FAILURE HISTORY · 6
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-07-01 | CVE-2026-58025 | critical | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * |
| 2026-07-01 | CVE-2026-58025 | critical | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * |
| 2026-07-01 | CVE-2026-14363 | critical | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4. |
| 2026-07-01 | CVE-2026-14363 | critical | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4. |
| 2026-07-01 | CVE-2026-58521 | critical | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4. |
| 2026-07-01 | CVE-2026-58521 | critical | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4. |
DOSSIER SOURCES
- MediaWiki - Wikipedia · en.wikipedia.org
- Wikimedia Foundation - Wikipedia · en.wikipedia.org
- WikiStats - Mediawiki statistics · wikistats.wmcloud.org
Open questions: exact founding year of MediaWiki · Wikimedia Foundation HQ location
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-08-20 19:08:31.688834+00:00