This vulnerability arises from improper pathname validation in the MediaWiki CSS extension, permitting path traversal. Based on the description, it is inferred that an attacker could construct crafted URLs to reference files outside the intended extension directory. The weakness is identified as CWE‑22.

Affected products include the MediaWiki CSS extension versions 1.39, 1.43, and 1.44. The vulnerability is documented for these releases and would impact any MediaWiki installation deploying the CSS extension in these versions. No newer versions are listed as affected.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would involve an attacker sending specially crafted requests to the extension directory to bypass pathname restrictions.