PT-2026-24147 · Mediawiki · Kbucket

Kcnotes · Published 2026-03-09 · Updated 2026-03-10 · CVE-2026-30917

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Bucket versions prior to 2.1.1

Description Bucket is a MediaWiki extension used to store and retrieve structured data on articles. A stored cross-site scripting (XSS) issue exists that allows malicious code to be inserted into any Bucket table field with a PAGE type. This code will execute when a user views the corresponding Bucket namespace page.

Recommendations Update to Bucket version 2.1.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-30917

GHSA-8JRP-37WC-5V7C

Affected Products

Kbucket

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30917.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-30917 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30917 · Security Note
• https://github.com/weirdgloop/mediawiki-extensions-Bucket/security/advisories/GHSA-8jrp-37wc-5v7c · Note
• https://github.com/weirdgloop/mediawiki-extensions-Bucket/commit/cba9cf9c8751e9f3e6d559f44cadc39b84f7bff6 · Note
• https://github.com/weirdgloop/mediawiki-extensions-Bucket/commit/46ec08876ba9064987f20e8f42690854202a73ff · Note
• https://twitter.com/infoflowcloud/status/2031295609232044154 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2031440939500102005 · Twitter Post
• https://twitter.com/CVEnew/status/2031294597692010560 · Twitter Post
• https://t.me/CVEtracker/46952 · Telegram Post