CVE-2026-58025 is a critical flaw (CVSS 9.8) in Wikimedia MediaWiki. Deserialization of untrusted data in the import and logging code can lead to code execution. Upgrade to 1.46.0, 1.45.4, 1.44.6 or 1.43.9, depending on the release branch you run, and limit who can import pages.
What's affected
- MediaWiki before 1.46.0, 1.45.4, 1.44.6 and 1.43.9, per the record.
- Files named: includes/Import/WikiImporter.php, includes/Import/WikiRevision.php and includes/Logging/LogEntryBase.php.
- Fixed versions: 1.46.0, 1.45.4, 1.44.6 and 1.43.9.
How to check if you're exposed
Open Special:Version on your wiki and read the MediaWiki version. Compare it with the fixed version for your branch. The record references a Phabricator task, though that page asks for a login, so use the release announcements for details.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Upgrade to the fixed version for your branch.
- Limit who can import pages until you finish.
- Review import and log records for unfamiliar activity.
- Take a backup before upgrading.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
The record gives two classes: CWE-502 (Deserialization of Untrusted Data) and CWE-94 (Code Injection). Deserialization turns stored data back into live objects, and if an attacker controls that data, the objects can be made to run code. That is why the score is 9.8 with no login required in the vector.
The CISA KEV flag is false. The task page was not readable without login, so details beyond the record are not confirmed here.
MediaWiki ships fixes for several branches at once, which is why the record lists four versions. Pick the one that matches your branch and do not jump branches during an emergency fix unless your testing allows it. Extensions and skins should be checked for compatibility after any upgrade.
Quick check
Does it matter if my wiki is private?
Network exposure matters less than patching. Upgrade regardless.
Sources
Last reviewed: 19 October 2026.
