PT-2026-54894 · Mediawiki+1 · Mediawiki+1

CVE-2026-58025

·

Published

2026-07-01

·

Updated

2026-08-19

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.46.0 MediaWiki versions prior to 1.45.4 MediaWiki versions prior to 1.44.6 MediaWiki versions prior to 1.43.9
Description An unsafe deserialization of untrusted data exists in the LogItem import process. This issue is associated with the program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, and includes/Logging/LogEntryBase.Php, which could lead to remote code execution.
Recommendations Update to version 1.46.0 or later. Update to version 1.45.4 or later. Update to version 1.44.6 or later. Update to version 1.43.9 or later.

Exploit

Fix

DoS

RCE

Deserialization of Untrusted Data

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-502CWE-94

Related Identifiers

BDU:2026-10705
CVE-2026-58025

Affected Products

Mediawiki
Red Os