CVE-2026-58521: MediaWiki Cargo Extension SQLi Vulnerability

CVE-2026-58521 Overview

CVE-2026-58521 is a SQL injection vulnerability in the Wikimedia Foundation MediaWiki Cargo Extension. The flaw stems from improper neutralization of special elements used in SQL commands [CWE-89]. Attackers can inject arbitrary SQL into database queries executed by the extension without requiring authentication or user interaction.

The vulnerability affects Cargo Extension versions prior to 1.43.9, 1.44.6, and 1.45.4. Successful exploitation can compromise the confidentiality, integrity, and availability of the underlying MediaWiki database and dependent wiki content.

Critical Impact
Unauthenticated attackers can execute crafted SQL statements against wikis running vulnerable versions of the Cargo Extension, potentially exposing or modifying stored data.

Affected Products

Wikimedia Foundation MediaWiki Cargo Extension versions before 1.43.9
Wikimedia Foundation MediaWiki Cargo Extension versions before 1.44.6
Wikimedia Foundation MediaWiki Cargo Extension versions before 1.45.4

Discovery Timeline

2026-07-01 - CVE-2026-58521 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-58521

Vulnerability Analysis

The Cargo Extension provides structured data storage and querying capabilities for MediaWiki installations. It allows wiki editors to define tables and run queries against them using templates and parser functions. The vulnerability arises when the extension processes user-supplied input without adequate sanitization before incorporating it into SQL statements.

Because the attack vector is the network and requires no privileges or user interaction, remote actors can trigger the flaw by submitting crafted requests to a vulnerable wiki. Exploitation can lead to unauthorized data retrieval, modification of stored records, or disruption of Cargo-backed queries used across wiki pages.

Root Cause

The root cause is improper neutralization of special elements in query construction [CWE-89]. Input flowing into SQL query builders inside the Cargo Extension is not sufficiently escaped or parameterized. Attackers can therefore break out of the intended query context and append or alter SQL clauses.

Attack Vector

A remote, unauthenticated attacker sends a crafted request containing malicious SQL fragments to an endpoint or template that invokes vulnerable Cargo query logic. The extension incorporates the payload into a database query, which the backend then executes. No authentication, elevated privileges, or user interaction are required to reach the vulnerable code path. Refer to the Wikimedia Phabricator Task and Wikimedia Gerrit Commit for technical details of the fix.

Detection Methods for CVE-2026-58521

Indicators of Compromise

Web server access logs containing SQL metacharacters such as single quotes, UNION, SELECT, or comment sequences in requests targeting Cargo query parameters.
Unexpected database errors or query timing anomalies in MediaWiki logs correlated with Cargo-related endpoints.
Unusual outbound queries from the MediaWiki database user account, particularly against cargo__* tables or the wiki's core tables.

Detection Strategies

Inspect MediaWiki request logs for anomalous input reaching Cargo parser functions and Special pages exposed by the extension.
Enable database query logging and alert on syntactically unusual statements originating from the MediaWiki application user.
Deploy a web application firewall ruleset that flags SQL injection patterns in query strings and POST bodies destined for wiki endpoints.

Monitoring Recommendations

Correlate spikes in MediaWiki 500-series responses with request payloads that include SQL syntax.
Monitor for exfiltration patterns such as large result sets returned from Cargo query endpoints to unauthenticated clients.
Track the installed Cargo Extension version across wiki fleets and alert when hosts run releases prior to 1.43.9, 1.44.6, or 1.45.4.

How to Mitigate CVE-2026-58521

Immediate Actions Required

Upgrade the Cargo Extension to version 1.43.9, 1.44.6, or 1.45.4 on the appropriate MediaWiki release branch.
Audit recent access logs and database activity for signs of SQL injection attempts against Cargo endpoints.
Restrict database privileges granted to the MediaWiki application user to the minimum required for wiki operation.

Patch Information

Wikimedia has released fixed versions of the Cargo Extension. Apply 1.43.9 for the 1.43.x branch, 1.44.6 for the 1.44.x branch, and 1.45.4 for the 1.45.x branch. The upstream fix is tracked in the Wikimedia Gerrit Commit and Wikimedia Phabricator Task.

Workarounds

Temporarily disable the Cargo Extension in LocalSettings.php if patching cannot be performed immediately.
Place vulnerable wikis behind a web application firewall configured to block SQL injection payloads in requests to Cargo Special pages and parser function endpoints.
Limit anonymous access to wikis running unpatched Cargo installations until upgrades are completed.

bash

# Configuration example: disable Cargo Extension in LocalSettings.php
# Comment out or remove the Cargo load line, then restart the web server
# wfLoadExtension( 'Cargo' );