VulnSocial

CVE-2026-58025PoC(mediawiki / mediawiki)

MEDIUMCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch mediawiki mediawiki systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

mediawiki CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-94CWE-502

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mediawiki

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 3 signals
  • PoC mentioned or linked in 3 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Peaked 2d ago at 1 mentions (2026-07-30); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
mediawiki
Products
mediawiki

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-07-30: 1Mentions · 2026-08-01: 1Mentions · 2026-08-03: 1PoC Mentioned / Linked · 2026-07-30: 1PoC Mentioned / Linked · 2026-08-01: 1PoC Mentioned / Linked · 2026-08-03: 1Exploit Tool / Code · 2026-07-30: 1Exploit Tool / Code · 2026-08-01: 1Exploit Tool / Code · 2026-08-03: 1Patch / Workaround · 2026-07-30: 1Patch / Workaround · 2026-08-01: 1Technical Details · 2026-07-30: 1Technical Details · 2026-08-01: 1Technical Details · 2026-08-03: 107-3008-0108-03
Signal classification2 categories
PoC
266.7%
Exploit
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-301
PoC1
2026-08-011
PoC1
2026-08-031
Exploit1
Full discourse3 posts
  • ThreatWire@ThreatWire_
    PoC

    🚨 A public PoC has been released for CVE-2026-58025 (CVSS 9.8) affecting MediaWiki. The deserialization flaw could lead to RCE via malicious log imports. Upgrade to 1.43.9, 1.44.6, 1.45.4, or 1.46.0. 🔗 https://github.com/shinthink/CVE-2026-58025 #MediaWiki #RCE #CVE #CyberSecurity

    Post summary

    A public PoC for a high‑severity MediaWiki RCE (CVE-2026-58025) was released with a GitHub link, and the vendor advises upgrading to mitigate.

    021076285.5K
    1.7K followersView on X
  • Dark Web Informer@DarkWebInformer
    PoC

    🚨 PoC for CVE-2026-58025, a CVSS 9.8 MediaWiki deserialization flaw that could enable RCE through malicious log entry imports. Exploitation requires import permissions. Upgrade to 1.43.9, 1.44.6, 1.45.4, or 1.46.0. GitHub: https://github.com/shinthink/CVE-2026-58025 https://t.co/4fP7xbLvwD

    Post summary

    A PoC for CVE‑2026‑58025 with a CVSS 9.8 score is showcased on GitHub, detailing an RCE via log imports, and the text recommends patching by upgrading to certain MediaWiki releases.

    0170511612.8K
    241.7K followersView on X
  • dbugs@ptdbugs
    Exploit

    A PoC/exploit has been discovered for vulnerability CVE-2026-58025 PT ID: PT-2026-54894 Vendor: Wikimedia Foundation Product: MediaWiki Description: An unsafe deserialization of untrusted data exists in the LogItem import process. This issue is associated with the program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, and includes/Logging/LogEntryBase.Php, which could lead to remote code execution. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-54894 • https://github.com/shinthink/CVE-2026-58025 #dbugs_vuln

    Post summary

    An exploit (PoC) for CVE-2026-58025 was released, including GitHub code, indicating remote code execution via unsafe deserialization in MediaWiki’s import process.

    00000506
    2.7K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appmediawikimediawiki---
Appmediawikimediawiki1.46.0--

Explore more

Back to dashboardmediawiki CVEsmediawiki vulnerabilities