CVE-2026-52854

Received Received - Intake

Stored XSS in Maps MediaWiki Extension via Leaflet Overlays

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-52854

Affected Vendors & Products

Vendor	Product	Version / Range
mediawiki	maps	12.1.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Maps extension for MediaWiki before version 12.1.3. The display_map parser function allows attacker-controlled HTML in the overlays parameter. The jQuery.leaflet.js file uses the overlay name as a layer-control label without proper escaping, enabling script execution when users view or preview affected maps.

Detection Guidance

Check the version of the Maps extension installed on your MediaWiki instance. If it is earlier than 12.1.3, the system is vulnerable. Review recent edits or previews of maps for unusual or malicious wikitext in the overlays parameter.

Impact Analysis

A wiki user with edit permissions can inject malicious wikitext that executes scripts in the browser of anyone viewing the map. This can lead to unauthorized data access or actions performed on behalf of the affected user, depending on their permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade the Maps extension to version 12.1.3 or later immediately. Restrict edit permissions to trusted users only until the upgrade is completed. Monitor recent edits for suspicious content and remove any malicious wikitext found.

Hi! I’m here to help you understand CVE-2026-52854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70