CVE-2026-34095

In MediaWiki the action=raw handler is meant to return the raw contents of a subpage. The vulnerability causes the server to respond with a Content‑Type header of text/html when the request header indicates text/javascript, allowing the browser to interpret injected JavaScript as executable code. This misreporting of the MIME type can facilitate cross‑site scripting attacks. The flaw originates in the ActionEntryPoint and FauxResponse components that build the HTTP response and is classified as a representation error (CWE‑668).

All MediaWiki releases older than 1.43.7, 1.44.4, or 1.45.2 are affected. Sites that enable the action=raw feature for user‑controlled subpages are at risk, regardless of whether the attacker is authenticated or not.

The CVSS score is 6.1, and the EPSS score is < 1%, and the vulnerability is not listed in CISA KEV. The attack vector is a straightforward HTTP request to Special:Mypage?action=raw with the content‑type header set to text/javascript and a subpage title that contains malicious payload. An attacker can supply arbitrary titles, leading to the server delivering the payload under a text/html type, thereby enabling XSS. While no public exploits have been reported, the combination of user‑controlled subpage names, the action=raw feature, and the MIME type mismatch presents a realistic threat.