CVE-2026-14363 is an SQL injection in the Cargo extension for MediaWiki, rated 9.8 (critical). It sits in the Special:Drilldown page, which anonymous users can reach by default. The record lists the fixed versions as 1.43.9, 1.44.6 and 1.45.4. Update Cargo through your normal MediaWiki security release.
What's affected
- Product: Cargo extension for MediaWiki, from the Wikimedia Foundation.
- Affected: the record lists versions before 1.43.9, 1.44.6 and 1.45.4, which are the same numbers as the MediaWiki security releases for the 1.43, 1.44 and 1.45 branches.
- Fixed: 1.43.9, 1.44.6 and 1.45.4. The Wikimedia security task for this issue refers to the supplementary announcement for extensions and skins patched in those releases.
- Exposure: the task says Special:Drilldown is accessible to anonymous users by default, so an attacker would not need an account.
- Severity: 9.8 with the record's CWE-89. Not on the CISA Known Exploited Vulnerabilities list.
The task is titled as SQL injection in Special:Drilldown. It names the file CargoAppliedFilter.php and its checkSQL() function, where user supplied values were joined into SQL text. Two code changes in Wikimedia's Gerrit add stricter validation of date values in the drilldown filters.
How to check if you're exposed
On the wiki, open Special:Version. The installed software table lists the Cargo extension with its version or the Git revision it was installed from. Compare it with the fixed versions above, and note the MediaWiki core version too, since the extension branches follow core releases.
If you manage the files directly, check the extension directory:
cd extensions/Cargo && git log -1 --format="%h %ad %s" && git describe --tags --always
Next, find out whether the page is exposed. Visit Special:Drilldown on a private browsing session with no login. If it loads, it is reachable by anonymous users, which matches the default described in the task.
Finally, check the web server and database logs for unusual requests to Special:Drilldown with date filter parameters that contain quote characters or SQL keywords. Such requests do not prove a successful attack, but they tell you whether someone was probing.
What to do now
- Update the Cargo extension to the version that matches your MediaWiki branch: 1.43.9, 1.44.6 or 1.45.4 or later. Use the MediaWiki security release for your branch where possible.
- If you cannot update immediately, consider restricting access to Special:Drilldown at the web server or with a MediaWiki permissions change, after testing what it breaks.
- Check that the database account used by MediaWiki has only the privileges it needs. It should not be able to read tables unrelated to the wiki.
- Review web and database logs for odd requests to Special:Drilldown from before the update.
- If you find signs of probing, rotate credentials stored in the wiki database and review user accounts.
- Subscribe to the MediaWiki announcements list so the next extension fix reaches you quickly.
Why it matters
SQL injection is CWE-89, improper neutralization of special elements used in an SQL command. The program builds a database query by joining text, and some of that text comes from the user. If the user can include characters that the database treats as syntax, they can change what the query does. The Wikimedia task describes the cause plainly: the filter code performed several string concatenations with user supplied input, and its recommended fix is to build parameterized queries with MediaWiki's database abstractions instead of concatenating strings.
Two things raise the severity. First, the page is open to anonymous visitors by default, so no login stands between the internet and the flaw. Second, the stated impact is theft of data from the database. A wiki database can hold password hashes, email addresses, private pages and session data, depending on how the site is configured. The record scores it 9.8 for those reasons.
The task is also a useful example of how this class of bug survives. The first change adds validation for date values. The report itself notes there may be other parameters that need the same treatment, and recommends reviewing the rest of the extension for string concatenation in SQL. Validation of inputs is a fine second layer, but parameterized queries remove the class of bug rather than patching one parameter at a time.
For operators, the lesson is about extensions. MediaWiki core gets most of the attention, and extensions are updated on their own schedule. Keep a list of the extensions you run, check each one when a security release comes out, and remove the ones you no longer use. A dynamic scan of your wiki, run on a schedule, is a cheap way to catch injection in pages like this one.
Try it yourself
Injection flaws live in running applications, which is where dynamic testing looks. This demo shows a DAST scan of a web app.
Click through it at your own pace, or open it full screen.
Quick check
Do I need a login to be at risk?
The Wikimedia task says Special:Drilldown is accessible to anonymous users by default, so no account is needed on a default configuration.
Which Cargo version should I install?
Use the version that matches your MediaWiki branch: 1.43.9, 1.44.6 or 1.45.4, or later. Check the Wikimedia release announcement for your branch if unsure.
Sources
- Wikimedia Phabricator task T422774
- Gerrit change 1269701 (referenced by the record)
- Gerrit change 1279498 (referenced by the record)
Last reviewed: 19 October 2026.
