CVE-2026-58025 Remote Code Execution via Unsafe Deserialization in LogItem Import

What is CVE-2026-58025?

CVE-2026-58025 is a medium-severity unsafe deserialization vulnerability in Mediawiki Mediawiki, published on 1 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki.

This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php.

This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

Weakness: CWE-94, CWE-502

Which versions are affected by CVE-2026-58025?

It affects 1 product.

Products include Mediawiki Mediawiki.

How do I fix CVE-2026-58025?

Upgrade to a fixed version.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-58025 being exploited?

There is no known exploitation of CVE-2026-58025 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in Mediawiki Mediawiki

• CVE-2023-37303 Denial of service in n/a Critical 9.8
• CVE-2022-29904 SQL injection in n/a Critical 9.8
• CVE-2022-29906 Missing authorization in n/a Critical 9.8
• CVE-2022-28205 Business logic in n/a Critical 9.8
• CVE-2022-28206 Missing authorization in n/a Critical 9.8

All Mediawiki Mediawiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-58025, GHSA-28rr-rpqp-g8c8, MINI-8frw-qcqf-2g37, MINI-hcc4-2j3h-985c, MINI-r8pv-8gq3-7frg, UBUNTU-CVE-2026-58025.