CVE-2026-52854

Name of the Vulnerable Software and Affected Versions Maps versions prior to 12.1.3

Description The display map parser function in the Leaflet service fails to properly escape the overlays parameter. This occurs because resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without sanitization. A user with edit permissions can store malicious wikitext that triggers script execution in the browser session of any user who previews or views the affected map, potentially allowing access to data or unauthorized actions.

Recommendations Update to version 12.1.3.