CVE-2026-103441CWE-502insecure-deserialization

CVE-2026-103441

published September 30, 2026

CVSS
7.2
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files.

This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

The record
Technical detail
CVSS
7.2 · NONE
CVSS v4.0
7.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/S:N/AU:Y/R:I/V:C/RE:M/U:Red
EPSS
0.00282 · 19.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-09-30T20:17Z
References (2)
https://gerrit.wikimedia.org/r/q/Id35bf747e48370e474d9b9444bd7520b24836e8d · c4f26cc8-17ff-4c99-b5e2-38fc1793eacchttps://phabricator.wikimedia.org/T435210 · c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 15:59Z
    Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
    cvelistv5