CVE-2026-52854: MediaWiki Maps Extension XSS Vulnerability

CVE-2026-52854 Overview

CVE-2026-52854 is a stored cross-site scripting (XSS) vulnerability in the Maps extension for MediaWiki. The flaw exists in the display_map parser function within the Leaflet service. The service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. Any wiki user with edit permission can store malicious wikitext that executes JavaScript when other users preview or view the affected map. The injected script runs in the viewing user's browser session and can access data or perform actions available to that user. The issue is fixed in version 12.1.3. The weakness is classified as CWE-79.

Critical Impact
A low-privileged wiki editor can inject persistent JavaScript that executes in the browser of any user viewing an affected map, enabling session data access and actions on their behalf.

Affected Products

ProfessionalWiki Maps extension for MediaWiki, versions prior to 12.1.3
Deployments using the Leaflet mapping service via the display_map parser function
MediaWiki instances that permit user-supplied overlays values in wikitext

Discovery Timeline

2026-08-18 - CVE-2026-52854 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-52854

Vulnerability Analysis

The Maps extension exposes a display_map parser function that renders geographic data through the Leaflet JavaScript library. The overlays parameter accepts a list of layer names supplied through wikitext. Server-side code passes those values into map configuration data without validating them against the allowlist defined in egMapsLeafletAvailableOverlayLayers. Client-side code in resources/leaflet/jquery.leaflet.js then inserts each overlay name as an HTML label in the Leaflet layer control without escaping. An attacker with edit rights can embed script payloads inside an overlay name. The payload is stored in the wiki page and executes in the browser of every user who previews or views the page.

Root Cause

The root cause is a missing output-encoding step combined with absent input filtering. The Leaflet layer-control label is rendered as raw HTML rather than as text, and the PHP backend does not enforce the available-layers whitelist before persisting the value.

Attack Vector

Exploitation requires only edit permission on the wiki. The attacker crafts wikitext that invokes display_map with a malicious overlay name. When another user renders the page, the browser interprets the overlay string as HTML and runs the embedded script under the victim's session.

javascript

// Security patch in resources/leaflet/jquery.leaflet.js
// Escapes Leaflet layer-control labels before insertion
            let overlays = {};

            $.each(options.overlays, function(index, overlayName) {
-               overlays[overlayName] = new L.tileLayer.provider(overlayName).addTo(_this.map);
+               overlays[mw.html.escape(overlayName)] = new L.tileLayer.provider(overlayName).addTo(_this.map);
            });

            return overlays;

Source: GitHub Commit 737a993

php

// Security patch in src/LeafletService.php
// Enforces the available-layers whitelist server-side
        $params['imageLayers'] = $this->getJsImageLayers( $params['image layers'] );

+       $params['overlays'] = $this->filterToAvailable(
+           $params['overlays'],
+           $GLOBALS['egMapsLeafletAvailableOverlayLayers']
+       );
+       $params['layers'] = $this->filterToAvailable(
+           $params['layers'],
+           $GLOBALS['egMapsLeafletAvailableLayers']
+       );
+
        return new MapData( $params );
    }

+   private function filterToAvailable( array $values, array $available ): array {
+       return array_values(
+           array_filter(
+               $values,
+               static fn ( string $value ): bool => ( $available[$value] ?? false ) === true
+           )
+       );
+   }

Source: GitHub Commit 737a993

Detection Methods for CVE-2026-52854

Indicators of Compromise

Wiki page revisions containing display_map invocations with overlays= values that include HTML tags, angle brackets, or JavaScript event handlers such as onerror or onclick.
Overlay names in stored wikitext that do not appear in the configured egMapsLeafletAvailableOverlayLayers allowlist.
Unexpected outbound requests from viewer browsers to attacker-controlled hosts after loading map-enabled pages.

Detection Strategies

Scan the MediaWiki revision and text tables for overlays parameter values that contain <, >, ", ', or javascript: substrings.
Review Content Security Policy (CSP) violation reports for inline script executions originating on pages that embed maps.
Diff current Maps extension version against 12.1.3 and correlate to pages created or edited before the upgrade.

Monitoring Recommendations

Enable web server access logging and alert on POST requests to api.php or index.php that modify pages containing the {{#display_map: token.
Monitor browser-side error telemetry for script errors on map-rendering pages, which can signal payload delivery.
Track edits by newly registered accounts, since the attack requires only the edit permission.

How to Mitigate CVE-2026-52854

Immediate Actions Required

Upgrade the Maps extension to version 12.1.3 or later on all MediaWiki installations.
Audit existing pages containing display_map calls and remove or sanitize overlay values that fall outside the configured allowlist.
Revoke edit permissions for untrusted accounts until the patch is applied.

Patch Information

The fix is available in Maps 12.1.3. The patch escapes overlay names with mw.html.escape in resources/leaflet/jquery.leaflet.js and adds a filterToAvailable method in src/LeafletService.php that drops overlay and layer values not present in egMapsLeafletAvailableOverlayLayers or egMapsLeafletAvailableLayers. See the GitHub Security Advisory GHSA-4h7g-5542-v3fc, the pull request #899, and the 12.1.3 release notes.

Workarounds

Restrict the edit permission to trusted users until the upgrade is complete.
Deploy a strict Content Security Policy that disallows inline script execution on wiki pages.
Temporarily disable the Leaflet mapping service or the display_map parser function in LocalSettings.php.

bash

# Configuration example: upgrade via Composer and restrict overlays allowlist
cd /path/to/mediawiki/extensions/Maps
composer require mediawiki/maps:^12.1.3

# In LocalSettings.php, constrain the Leaflet overlay allowlist
# so ParamProcessor drops unknown overlay names before rendering:
$egMapsLeafletAvailableOverlayLayers = [
    'OpenRailwayMap' => true,
    'OpenSeaMap'     => true,
];