CVE-2026-100381 Wikimedia Foundation CVE debrief

Who should care

Defenders responsible for Mediawiki installations with the UploadWizard Extension should assess exposure and prioritize updates to mitigate potential XSS risks. Defenders need to verify exposure of the UploadWizard Extension in their Mediawiki installations. There is a risk of XSS attacks if the extension is not updated to a fixed version. Defenders should review and restrict user input to prevent XSS attacks. The vulnerability requires verification from官方

Why it matters

CVE-2026-100381 is a Cross-Site Scripting (XSS) vulnerability in the Mediawiki - UploadWizard Extension. Defenders should prioritize verifying exposure and assessing the need for updates to mitigate potential XSS risks. The vulnerability affects versions before 1.46.1, 1.45.5, and 1.43.10, and specific details on exploitation or impact are limited.

• Defenders need to verify exposure of the UploadWizard Extension in their Mediawiki installations.
• There is a risk of XSS attacks if the extension is not updated to a fixed version.
• Defenders should review and restrict user input to prevent XSS attacks.
• The vulnerability requires verification from official sources for accurate impact assessment.

Technical summary

The Mediawiki - UploadWizard Extension is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This affects versions before 1.46.1, 1.45.5, and 1.43.10. The vulnerability requires verification from official sources for accurate impact assessment. Defenders should prioritize verifying exposure of the UploadWizard Extension in their Mediawiki installations and assess the need for updates to mitigate potential XSS risks. Review compensating controls for exposed systems while remediation is scheduled and verified.

Defensive priority

Defenders should prioritize verifying exposure of the UploadWizard Extension in their Mediawiki installations and assess the need for updates to mitigate potential XSS risks.

Recommended defensive actions

• Verify the version of Mediawiki - UploadWizard Extension in use and update to a fixed version if necessary
• Review and restrict user input to prevent XSS attacks
• Monitor for potential XSS attacks targeting the UploadWizard Extension
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but specific details on exploitation or impact are limited. The vulnerability affects versions before 1.46.1, 1.45.5, and 1.43.10. Defenders should verify the version of Mediawiki - UploadWizard Extension in use and review and restrict user input to prevent XSS attacks. The CVE record was published on 2026-09-25T22:17:09.027Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.