CVE-2026-103045 in MediaWiki
Summary
by MITRE • 09/30/2026
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Refreshed skin allows Stored XSS.
This issue affects Mediawiki - Refreshed skin: before 1.46.1, 1.45.5, 1.43.10.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The identified vulnerability represents a critical security flaw within the Wikimedia Foundation's MediaWiki platform, specifically targeting the Refreshed skin component prior to versions 1.46.1, 1.45.5, and 1.43.10. This issue is classified as an improper neutralization of input during web page generation, commonly known as cross-site scripting or XSS. Unlike reflected XSS attacks that require tricking a user into clicking a malicious link, this vulnerability facilitates stored cross-site scripting. In a stored XSS scenario, the malicious script payload is permanently saved on the target server, typically within database entries such as wiki pages, comments, or profile fields. Consequently, every time a victim loads the affected page containing the injected code, the browser executes the script automatically without further user interaction beyond viewing the content.
The technical root cause lies in insufficient input validation and output encoding mechanisms within the Refreshed skin's rendering engine. When user-supplied data is processed for display on wiki pages, the application fails to properly sanitize special characters that have semantic meaning in HTML and JavaScript contexts. This allows an attacker to inject executable scripts into the page content. Because MediaWiki is a collaborative platform where users frequently edit and view shared documentation, this flaw poses a significant risk. An authenticated user with editing privileges can embed malicious code within any editable field associated with the Refreshed skin's interface or content areas. Once saved, this payload becomes persistent across all subsequent views of that page by other users, including administrators who may have elevated permissions to execute sensitive actions on behalf of the organization.
The operational impact of this vulnerability is severe due to its potential for widespread exploitation and high-privilege execution. Attackers can leverage stored XSS to steal session cookies, thereby hijacking user accounts and gaining unauthorized access to private wiki spaces or administrative functions. Furthermore, malicious scripts can perform actions on behalf of the victim, such as modifying page content, defacing websites, or redirecting users to phishing sites designed to harvest credentials. In enterprise environments using MediaWiki for internal knowledge bases, this could lead to data exfiltration, intellectual property theft, and significant reputational damage. The persistence of the attack vector means that remediation requires not only patching the software but also actively scanning existing content for injected payloads, which can be labor-intensive depending on the volume of stored data.
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It is further categorized under MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers. The stored nature of the attack also relates to persistence mechanisms where malicious code remains on the system until explicitly removed. To mitigate this risk, organizations must immediately upgrade MediaWiki and its associated skins to version 1.46.1 or later for stable releases, or apply specific backported patches if available for older supported branches like 1.45.x and 1.43.x. Additionally, administrators should implement strict Content Security Policy headers to restrict script execution sources and enable input filtering extensions that enforce stricter sanitization rules on user-generated content. Regular security audits of stored data are recommended to detect any residual malicious scripts injected prior to the patch application.