CVE-2026-58025: Remote Code Execution via Unsafe Deserialization in LogItem Import
Published Jul 1, 2026
·Updated
Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php.
This issue affects MediaWiki: from before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
Affected Software
5 affected components
Wikimedia Foundation MediaWiki>1.0.0<=1.46.0
MediaWiki MediaWiki>=1.43.0<1.43.9
MediaWiki MediaWiki>=1.44.0<1.44.6
MediaWiki MediaWiki>=1.45.0<1.45.4
MediaWiki MediaWiki=1.46.0-rc0
Event History
Jul 1, 2026
CVE Published
via MITRE·03:23 PM
Data Sourced
via MITRE·03:23 PM
DescriptionWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-58025?
CVE-2026-58025 has a medium severity rating of 5.9.
2
What type of vulnerability is CVE-2026-58025?
CVE-2026-58025 is a remote code execution vulnerability caused by unsafe deserialization.
3
How can I mitigate CVE-2026-58025?
To mitigate CVE-2026-58025, upgrade to MediaWiki version 1.46.0 or later.
4
What products are affected by CVE-2026-58025?
CVE-2026-58025 affects versions of MediaWiki prior to 1.46.0 and 1.45.4.
5
What components of MediaWiki are involved in CVE-2026-58025?
CVE-2026-58025 involves the program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, and includes/Logging/LogEntryBase.Php.