Description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
Published: 2026-07-01
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper neutralization of special elements used in an SQL command in the Wikimedia Foundation MediaWiki Cargo Extension creates a classic SQL injection flaw described by CWE-89. The issue resides in the year-range filter supplied by Cargo queries, allowing attackers to inject arbitrary SQL that can read, modify, or delete data stored in the database, potentially compromising confidentiality, integrity, and availability.

Affected Systems

All releases of the MediaWiki Cargo Extension that precede MediaWiki 1.43.9, 1.44.6, or 1.45.4 are affected. Versions 1.43.9 or newer, 1.44.6 or newer, and 1.45.4 or newer, respectively, contain the patch and are not vulnerable.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate risk, while the EPSS score of less than 1% points to a very low likelihood of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the web interface where a user can supply a crafted year range in a Cargo query; if the user has sufficient permissions to execute queries, the injection can be performed.

Generated by OpenCVE AI on July 17, 2026 at 12:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Cargo Extension to the latest patched release (at least v1.43.9 for MediaWiki 1.43.x, v1.44.6 for 1.44.x, or v1.45.4 for 1.45.x).
  • Disallow or tightly restrict the use of the year-range filter in custom Cargo queries until the patch is applied, by removing the filter from public query templates or adding server-side validation.
  • Reduce the database privileges granted to Cargo to read-only if possible, limiting the damage an injected query could cause.

Generated by OpenCVE AI on July 17, 2026 at 12:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Description Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
Title SQLi in Cargo extension via year range filter
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: wikimedia-foundation

Published:

Updated: 2026-07-01T17:58:23.995Z

Reserved: 2026-07-01T03:40:44.769Z

Link: CVE-2026-58521

cve-icon Vulnrichment

Updated: 2026-07-01T17:58:17.300Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-17T12:30:05Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')