CVE-2026-58521 is a critical flaw (CVSS 9.8) in the Cargo extension for MediaWiki. Improper neutralization in a year range filter allows SQL injection without a login. Update Cargo to the fixed release on the 1.43.9, 1.44.6 or 1.45.4 branch, and check Special:Version afterwards.
What's affected
- Cargo extension for MediaWiki before 1.43.9, 1.44.6 and 1.45.4, per the record.
- Fixed versions: 1.43.9, 1.44.6 and 1.45.4.
How to check if you're exposed
Open Special:Version on your wiki and find Cargo under installed extensions. Compare the version to the fixed one for your branch. Wikis that do not install Cargo are not affected.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Update the Cargo extension to the fixed release for your branch.
- Back up the wiki database first.
- Use a database account for the wiki with the least rights it needs.
- Review database and web logs for odd queries around the year range filter.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
This is CWE-89 (SQL Injection). User input reached an SQL statement without proper neutralization. The Phabricator task title names a year range filter as the entry point. The vector shows no login required.
The CISA KEV flag is false.
Cargo stores structured data from wiki pages in database tables and queries it with a query language that is translated into SQL. That translation layer is where input validation has to hold. A year range filter is the sort of parameter that looks harmless because it holds numbers, which is why it is easy to skip when escaping.
Quick check
Which part of Cargo is at fault?
The Phabricator task title says the year range filter.
Sources
Last reviewed: 19 October 2026.
