PT-2026-54897 · Mediawiki · Centralauth+1

Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-58028

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.46.0 MediaWiki versions prior to 1.45.4 MediaWiki versions prior to 1.44.6 MediaWiki versions prior to 1.43.9 CentralAuth versions prior to 1.46.0 CentralAuth versions prior to 1.45.4 CentralAuth versions prior to 1.44.6 CentralAuth versions prior to 1.43.9

Description Improper neutralization of input during web page generation leads to Cross-site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. This issue occurs when pretty-printed API output is combined with centralauthtoken and certain gadgets. The flaw is associated with the following program files: includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, and includes/LogFormatter/PermissionChangeLogFormatter.Php.

Recommendations Update MediaWiki to version 1.46.0, 1.45.4, 1.44.6, or 1.43.9 depending on the current release branch. Update CentralAuth to version 1.46.0, 1.45.4, 1.44.6, or 1.43.9 depending on the current release branch.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-58028

Affected Products

Centralauth

Mediawiki

References · 14

• https://cve.org/CVERecord?id=CVE-2026-58028 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-58028 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-58028 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-58028 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-58028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-58028 · Security Note
• https://ubuntu.com/security/CVE-2026-58028 · Vendor Advisory
• https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1306308 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1306211 · Note
• https://t.me/CVEtracker/58591 · Telegram Post
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/1306216 · Note
• http://phabricator.wikimedia.org/T422306 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/1306320 · Note
• https://phabricator.wikimedia.org/T422306 · Note