Path Traversal Vulnerability in Wikimedia Foundation MediaWiki - CSS Extension
CVE-2026-0669

7.5HIGH

Key Information:

Vendor

Wikimedia Foundation

Status
Mediawiki - Css Extension
Vendor
CVE Published:
7 January 2026

What is CVE-2026-0669?

A vulnerability in the MediaWiki - CSS extension allows unauthorized access to restricted directories due to improper pathname limitation. This flaw permits attackers to traverse the file system, potentially leading to exposure of sensitive files and data. Users of MediaWiki versions 1.44, 1.43, and 1.39 are at risk, necessitating timely updates to ensure security.

Affected Version(s)

MediaWiki - CSS extension 1.44

MediaWiki - CSS extension 1.43

MediaWiki - CSS extension 1.39

References

https://phabricator.wikimedia.org/T401526
https://gerrit.wikimedia.org/r/q/Ia15bf3f2e5a341868568492...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Radman Siddiki
.