Description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
Published: 2026-07-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of special elements in SQL commands within the MediaWiki Cargo Extension allows injection of arbitrary SQL (CWE-89) through a year-range filter in Cargo queries. Based on the description, it is inferred that an attacker could read, modify, or delete data in the underlying database, compromising confidentiality, integrity, and availability.

Affected Systems

All releases of the MediaWiki Cargo Extension preceding MediaWiki 1.43.9, 1.44.6, or 1.45.4 are affected. Versions 1.43.9 and later for MediaWiki 1.43.x, 1.44.6 and later for MediaWiki 1.44.x, and 1.45.4 and later for MediaWiki 1.45.x contain the fix.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while an EPSS score of less than 1% suggests a very low probability of current exploitation. The vulnerability is not listed in CISA KEV. Based on the way Cargo queries are processed, it is inferred that the attack vector would be via the web interface where a user supplies a crafted year range in a query.

Generated by OpenCVE AI on August 1, 2026 at 22:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Cargo Extension to the latest patched release (at least v1.43.9 for MediaWiki 1.43.x, v1.44.6 for 1.44.x, or v1.45.4 for 1.45.x).
  • Disable or restrict the use of the year-range filter in custom Cargo queries until the patch is applied, for example by removing the filter from public templates or adding server-side validation.
  • Limit the database privileges granted to Cargo to read-only where feasible, reducing the impact of a successful injection.

Generated by OpenCVE AI on August 1, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Wikimedia
Wikimedia mediawiki-cargo Extension
Vendors & Products Wikimedia
Wikimedia mediawiki-cargo Extension

Wed, 01 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
Title SQLi in Cargo extension via year range filter
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L'}

Subscriptions

Wikimedia Mediawiki-cargo Extension
cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-07-01T17:58:23.995Z

Reserved: 2026-07-01T03:40:44.769Z

Link: CVE-2026-58521

cve-icon Vulnrichment

Updated: 2026-07-01T17:58:17.300Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T23:00:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')