CVE-2026-103441
Awaiting Analysis Awaiting Analysis - Queue

Deserialization Flaw in MediaWiki Wikibase Extension

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: wikimedia-foundation

Description
Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-103441
EUVD
EUVD-2026-90073

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
the_wikimedia_foundation mediawiki_wikibase_extension to 1.46 (inc)
the_wikimedia_foundation mediawiki_wikibase_extension to 1.45 (inc)
the_wikimedia_foundation mediawiki_wikibase_extension to 1.43 (inc)
the_wikimedia_foundation mediawiki 1.46
the_wikimedia_foundation mediawiki 1.45
the_wikimedia_foundation mediawiki 1.43
the_wikimedia_foundation wikibase 1.7.1
the_wikimedia_foundation wikibase *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-103441 is a deserialization vulnerability in the Wikimedia Foundation MediaWiki Wikibase extension. It allows attackers to delete arbitrary files on the server by sending a crafted API request with malicious serialized PHP code. The flaw occurs because the extension processes user-controlled input via PHP's unserialize() function without proper restrictions.

Detection Guidance

To detect this vulnerability, check MediaWiki and Wikibase extension versions against affected releases (1.46, 1.45, 1.43). Monitor API logs for requests using contentformat=application/vnd.php.serialized to the action=parse endpoint. Look for unusual file deletion patterns in server logs or Smarty template engine errors.

Impact Analysis

This vulnerability allows unauthenticated attackers to delete critical files on the server, including application files, configurations, caches, or sensitive system files. While it doesn't directly enable remote code execution, it can disrupt services, expose sensitive data, or serve as a stepping stone for further attacks if combined with other vulnerabilities.

Compliance Impact

This vulnerability could lead to unauthorized file deletion, potentially violating data integrity and availability requirements under GDPR and HIPAA. Unauthorized access or deletion of sensitive data may result in compliance breaches, legal penalties, or reputational damage due to compromised data protection measures.

Mitigation Strategies

Apply available security patches from Wikimedia that remove support for serialized PHP input or restrict unserialize() to simple arrays. Disable the Widgets extension if installed. Update MediaWiki and Wikibase to patched versions. Restrict file deletion permissions for the web server process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103441. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart