[IT-SecNots] [MediaWiki-announce] MediaWiki Extensions and Skins Security Release Supplement (1.39.16/1.43.6/1.44.3/1.45.1)

[Manfredi Martorana <mmartorana AT wikimedia.org>]

Greetings-

With the security/maintenance release of MediaWiki
1.39.16/1.43.6/1.44.3/1.45.1, we would also like to provide this
supplementary announcement of MediaWiki extensions and skins with
now-public Phabricator tasks, security patches and backports [1]:

Citizen
+ (GHSA-g955-vw6w-v6pp, CVE-2025-62508) - Stored XSS in sticky header
button messages
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-g955-vw6w-v6pp

VisualData
+ (T387008, CVE-2026-0668) - VisualData extension: Regular Expression
Denial of Service (ReDoS) via crafted user input
https://gerrit.wikimedia.org/r/q/Ie08d9a8ceb2c9a22a635cfc27964353f14072dbf
https://gerrit.wikimedia.org/r/q/Ifbf9c2ade621226e14fe852f3217293772bf8bb8
https://gerrit.wikimedia.org/r/q/I893a9fca694a2613e29e149dea2d76d7f06063e5
https://gerrit.wikimedia.org/r/q/I4ff2737c9f0ba805267d1fc8296e7cff61241ee3

CSS
+ (T401526, CVE-2026-0669) - Path Traversal vulnerability in CSS extension
on certain web servers
https://gerrit.wikimedia.org/r/q/Ia15bf3f2e5a341868568492a736ac3dbf706c22e

UploadWizard
+ (T407157, CVE-2026-0671) - Multiple stored i18n/message-key XSSes in
UploadWizard
https://gerrit.wikimedia.org/r/q/I16de2211594ea9a686868ad7789f9879bf981fa1

ProofreadPage
+ (T409423, CVE-2026-0670) - Stored XSS through a system message and a
user-provided parameter in ProofreadPage
https://gerrit.wikimedia.org/r/q/I7c028db5ed81843aacd596b0ee4dc2980f5b6e3c

Wikibase
+ (T409737, CVE-2026-22710) - Stored XSS through autocomment system messages
https://gerrit.wikimedia.org/r/q/I8505700afda8096ef4e183280494232152767004

Monaco
+ (T411126, CVE-2026-22714) - i18n XSS, DoS and config SQLI
https://gerrit.wikimedia.org/r/q/I00b2e369fa189803380ca7409022a11b670d2500

GrowthExperiments
+ (T411144, CVE-2026-22713) - Stored XSS through edit summaries
https://gerrit.wikimedia.org/r/q/Iff01940a163ed87ec52f3a64ba6b2dbfa2759df3

ApprovedRevs
+ (T412068, CVE-2026-22712) - Bypassing the inline CSS sanitizer
https://gerrit.wikimedia.org/r/q/Iee1bf1cbc8a519899e7f9dde508856bd4e5a5d2a

CampaignEvents
+ (T410560, CVE-2026-0817) - CampaignEvents API missing authorization
exposes meeting and chat URLs
https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358

The Wikimedia Security Team recommends updating these extensions and/or
skins to the current master branch or relevant, supported release branch
[2] as soon as possible. Some of the referenced Phabricator tasks above
_may_ still be private. Unfortunately, when security issues are reported,
sometimes sensitive information is exposed and since Phabricator is
historical, we cannot make these tasks public without exposing this
sensitive information. If you have any additional questions or concerns
regarding this update, please feel free to contact security AT wikimedia.org
or file a security task within Phabricator [3].

[1] https://phabricator.wikimedia.org/T404620
[2] https://www.mediawiki.org/wiki/Version_lifecycle
[3] https://www.mediawiki.org/wiki/Reporting_security_bugs
_______________________________________________
MediaWiki-announce mailing list -- mediawiki-announce AT lists.wikimedia.org
To unsubscribe send an email to mediawiki-announce-leave AT lists.wikimedia.org