CVE-2026-58025 — Remote Code Execution via Unsafe Deserialization in LogItem Import

CVE-2026-58025

Remote Code Execution via Unsafe Deserialization in LogItem Import PUBLISHED

Description (CNA)

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Affected (CNA)

Vendor / product	Versions
Wikimedia Foundation / MediaWiki	affected * before 1.46.0, 1.45.4, 1.44.6, 1.43.9

CWE

CWE-502, CWE-94

References

https://phabricator.wikimedia.org/T422244

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.