CVE-2026-58025: MediaWiki Deserialization RCE Vulnerability

CVE-2026-58025 Overview

CVE-2026-58025 is an insecure deserialization vulnerability in Wikimedia Foundation MediaWiki. The flaw resides in the import and logging subsystems, specifically within includes/Import/WikiImporter.php, includes/Import/WikiRevision.php, and includes/Logging/LogEntryBase.php. Attackers holding elevated privileges can supply crafted serialized data that MediaWiki processes without adequate validation. The issue affects MediaWiki versions prior to 1.46.0, 1.45.4, 1.44.6, and 1.43.9. It is classified under [CWE-94] Improper Control of Generation of Code and is exploitable over the network.

Critical Impact
Authenticated attackers with high privileges can trigger deserialization of untrusted data, leading to code injection with high impact on integrity of the MediaWiki instance.

Affected Products

Wikimedia MediaWiki versions before 1.43.9
Wikimedia MediaWiki 1.44.x before 1.44.6 and 1.45.x before 1.45.4
Wikimedia MediaWiki versions before 1.46.0

Discovery Timeline

2026-07-01 - CVE-2026-58025 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58025

Vulnerability Analysis

The vulnerability stems from unsafe handling of serialized data within MediaWiki's XML import pipeline and log entry processing. WikiImporter.php and WikiRevision.php parse externally provided content during page imports. LogEntryBase.php reconstructs log parameters from stored serialized structures. When these components deserialize attacker-controlled payloads without strict type constraints, PHP object instantiation can trigger unintended magic methods such as __wakeup or __destruct. This behavior maps to [CWE-94], enabling code execution paths within the application context. The attack requires network access and high privileges, which limits the exploitable population to trusted operators such as importers or administrators.

Root Cause

The root cause is the use of PHP native deserialization on data flows that accept operator-supplied input. The three files invoke deserialization routines on values that originate from XML dump imports and stored log entry blobs. Without an allowlist of expected classes, the parser instantiates arbitrary object graphs. Existing gadget chains inside MediaWiki or bundled extensions can then be reused to alter application state.

Attack Vector

An authenticated attacker with import or logging privileges submits a crafted XML dump or manipulates stored log parameters. When MediaWiki processes the input through WikiImporter::handleRevision() or LogEntryBase::extractParams(), the malicious serialized object is instantiated. The resulting object chain executes side effects that compromise integrity of wiki content, configuration, or logs. No user interaction is required beyond the standard import workflow. Refer to the Wikimedia Task T422244 tracker for the vendor's technical discussion.

Detection Methods for CVE-2026-58025

Indicators of Compromise

Unexpected XML import events initiated by non-standard accounts within MediaWiki's Special:Import audit trail.
Log entries in logging table containing serialized payloads with class names outside MediaWiki's expected set.
PHP error or warning entries referencing __wakeup, unserialize, or class-not-found conditions tied to import operations.

Detection Strategies

Inspect MediaWiki application logs for calls to WikiImporter and LogEntryBase that produce deserialization warnings or fatal errors.
Monitor the web server for POST requests to Special:Import originating from accounts that do not routinely perform imports.
Search the logging database table for log_params values beginning with O: or a: patterns that indicate serialized PHP objects.

Monitoring Recommendations

Enable MediaWiki debug logging for the Import and LogEntry channels and forward events to a central log store.
Alert on any modification of user rights that grants the import or importupload permissions.
Track file writes and process executions from the PHP-FPM worker serving MediaWiki to identify post-exploitation activity.

How to Mitigate CVE-2026-58025

Immediate Actions Required

Upgrade MediaWiki to 1.46.0, 1.45.4, 1.44.6, or 1.43.9 as appropriate for the deployed branch.
Audit accounts holding the import, importupload, and administrator rights and revoke privileges no longer required.
Review recent import history and log table entries for suspicious serialized payloads.

Patch Information

Wikimedia Foundation addressed CVE-2026-58025 in MediaWiki releases 1.46.0, 1.45.4, 1.44.6, and 1.43.9. The fixes harden deserialization paths in includes/Import/WikiImporter.php, includes/Import/WikiRevision.php, and includes/Logging/LogEntryBase.php. See the Wikimedia Task T422244 for patch references and downstream advisories.

Workarounds

Disable the import feature by removing the import and importupload rights from all user groups until patches are applied.
Restrict network access to Special:Import using web server ACLs or reverse proxy rules.
Isolate the MediaWiki PHP process with least-privilege file system permissions to limit the impact of code injection.

bash

# Configuration example: restrict import rights in LocalSettings.php
$wgGroupPermissions['*']['import'] = false;
$wgGroupPermissions['*']['importupload'] = false;
$wgGroupPermissions['sysop']['import'] = false;
$wgGroupPermissions['sysop']['importupload'] = false;