Vulnerability-Lookup

CVE-2026-52854 (GCVE-0-2026-52854)

Vulnerability from cvelistv5 – Published: 2026-08-18 21:32 – Updated: 2026-08-19 18:33

Title

mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function

Summary

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 18:33 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/ProfessionalWiki/Maps/security…	x_refsource_CONFIRM
https://github.com/ProfessionalWiki/Maps/pull/899	x_refsource_MISC
https://github.com/ProfessionalWiki/Maps/commit/7…	x_refsource_MISC
https://github.com/ProfessionalWiki/Maps/blob/12.…	x_refsource_MISC
https://github.com/ProfessionalWiki/Maps/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
ProfessionalWiki	Maps	Affected: < 12.1.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52854",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T18:33:46.350742Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T18:33:53.281Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Maps",
          "vendor": "ProfessionalWiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 12.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user\u0027s browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-80",
              "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:32:09.253Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"
        },
        {
          "name": "https://github.com/ProfessionalWiki/Maps/pull/899",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ProfessionalWiki/Maps/pull/899"
        },
        {
          "name": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806"
        },
        {
          "name": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md"
        },
        {
          "name": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3"
        }
      ],
      "source": {
        "advisory": "GHSA-4h7g-5542-v3fc",
        "discovery": "UNKNOWN"
      },
      "title": "mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52854",
    "datePublished": "2026-08-18T21:32:09.253Z",
    "dateReserved": "2026-06-08T18:41:27.724Z",
    "dateUpdated": "2026-08-19T18:33:53.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-52854",
      "date": "2026-08-22",
      "epss": "0.00432",
      "percentile": "0.36305"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-52854\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-18T22:16:53.470\",\"lastModified\":\"2026-08-19T19:17:18.963\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user\u0027s browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"ProfessionalWiki\",\"product\":\"Maps\",\"versions\":[{\"version\":\"\u003c 12.1.3\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-19T18:33:46.350742Z\",\"id\":\"CVE-2026-52854\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"},{\"lang\":\"en\",\"value\":\"CWE-80\"}]}],\"references\":[{\"url\":\"https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ProfessionalWiki/Maps/pull/899\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-52854\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-19T18:33:46.350742Z\"}}}], \"references\": [{\"url\": \"https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-19T18:33:31.159Z\"}}], \"cna\": {\"title\": \"mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function\", \"source\": {\"advisory\": \"GHSA-4h7g-5542-v3fc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"ProfessionalWiki\", \"product\": \"Maps\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 12.1.3\"}]}], \"references\": [{\"url\": \"https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc\", \"name\": \"https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/ProfessionalWiki/Maps/pull/899\", \"name\": \"https://github.com/ProfessionalWiki/Maps/pull/899\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806\", \"name\": \"https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md\", \"name\": \"https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3\", \"name\": \"https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user\u0027s browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-80\", \"description\": \"CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-18T21:32:09.253Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-52854\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-19T18:33:53.281Z\", \"dateReserved\": \"2026-06-08T18:41:27.724Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-18T21:32:09.253Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-52854

Vulnerability from fkie_nvd - Published: 2026-08-18 22:16 - Updated: 2026-08-19 19:17

Severity

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md
	security-advisories@github.com	https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806
	security-advisories@github.com	https://github.com/ProfessionalWiki/Maps/pull/899
	security-advisories@github.com	https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3
	security-advisories@github.com	https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Maps",
          "vendor": "ProfessionalWiki",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 12.1.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user\u0027s browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3."
    }
  ],
  "id": "CVE-2026-52854",
  "lastModified": "2026-08-19T19:17:18.963",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-52854",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-19T18:33:46.350742Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-18T22:16:53.470",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ProfessionalWiki/Maps/pull/899"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4H7G-5542-V3FC

Vulnerability from github – Published: 2026-07-02 17:51 – Updated: 2026-07-02 17:51

Summary

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

Details

Summary

Stored XSS through wikitext can be performed by inserting malicious HTML into the overlays parameter of the display_map parser function when using the leaflet service.

Details

The maps extension doesn't escape overlay names before passing them to leaflet. Leaflet then inserts them as HTML: https://github.com/ProfessionalWiki/Maps/blob/ca5139fabd75f3c34f47ea3fd161306506b053bc/resources/lib/leaflet/leaflet.js#L5243

PoC

Preview the following wikitext, using the default configuration options of the extension:

{{#display_map:0,0|service=leaflet|overlays=OpenTopoMap.<img src=x onerror="alert(1);">}}

Impact

Stored XSS can be performed by any user with the edit permission.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mediawiki/maps"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "12.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52854"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T17:51:24Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nStored XSS through wikitext can be performed by inserting malicious HTML into the `overlays` parameter of the `display_map` parser function when using the leaflet service.\n\n### Details\nThe maps extension doesn\u0027t escape overlay names before passing them to leaflet.\nLeaflet then inserts them as HTML: https://github.com/ProfessionalWiki/Maps/blob/ca5139fabd75f3c34f47ea3fd161306506b053bc/resources/lib/leaflet/leaflet.js#L5243\n\n### PoC\nPreview the following wikitext, using the default configuration options of the extension:\n```\n{{#display_map:0,0|service=leaflet|overlays=OpenTopoMap.\u003cimg src=x onerror=\"alert(1);\"\u003e}}\n```\n\n### Impact\nStored XSS can be performed by any user with the `edit` permission.",
  "id": "GHSA-4h7g-5542-v3fc",
  "modified": "2026-07-02T17:51:24Z",
  "published": "2026-07-02T17:51:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ProfessionalWiki/Maps"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function"
}

ubuntu-cve-2026-52854

Vulnerability from osv_ubuntu

Published

2026-08-20 00:00

Modified

2026-08-20 00:00

Summary

Details

Severity

8.6 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-52854	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-52854	REPORT
	https://github.com/ProfessionalWiki/Maps/blob/12.…	REPORT
	https://github.com/ProfessionalWiki/Maps/commit/7…	REPORT
	https://github.com/ProfessionalWiki/Maps/pull/899	REPORT
	https://github.com/ProfessionalWiki/Maps/releases…	REPORT
	https://github.com/ProfessionalWiki/Maps/security…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "mediawiki",
            "binary_version": "1:1.27.4-3"
          },
          {
            "binary_name": "mediawiki-classes",
            "binary_version": "1:1.27.4-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "mediawiki",
        "purl": "pkg:deb/ubuntu/mediawiki@1:1.27.4-3?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.27.3-1",
        "1:1.27.4-1",
        "1:1.27.4-2",
        "1:1.27.4-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "mediawiki",
            "binary_version": "1:1.31.7-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "mediawiki-classes",
            "binary_version": "1:1.31.7-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "mediawiki",
        "purl": "pkg:deb/ubuntu/mediawiki@1:1.31.7-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.31.2-1ubuntu1",
        "1:1.31.5-1",
        "1:1.31.5-1ubuntu1",
        "1:1.31.5-2",
        "1:1.31.5-3",
        "1:1.31.5-3ubuntu1",
        "1:1.31.6-1",
        "1:1.31.7-1",
        "1:1.31.7-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "mediawiki",
            "binary_version": "1:1.35.6-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "mediawiki-classes",
            "binary_version": "1:1.35.6-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "mediawiki",
        "purl": "pkg:deb/ubuntu/mediawiki@1:1.35.6-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.35.3-1",
        "1:1.35.4-1",
        "1:1.35.5-1",
        "1:1.35.5-1ubuntu1",
        "1:1.35.5-1ubuntu2",
        "1:1.35.5-1ubuntu3",
        "1:1.35.6-1",
        "1:1.35.6-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "mediawiki",
            "binary_version": "1:1.39.7-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "mediawiki-classes",
            "binary_version": "1:1.39.7-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "mediawiki",
        "purl": "pkg:deb/ubuntu/mediawiki@1:1.39.7-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.39.4-2",
        "1:1.39.5-1",
        "1:1.39.6-1",
        "1:1.39.7-1",
        "1:1.39.7-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "mediawiki",
            "binary_version": "1:1.43.8+dfsg-2"
          },
          {
            "binary_name": "mediawiki-classes",
            "binary_version": "1:1.43.8+dfsg-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "mediawiki",
        "purl": "pkg:deb/ubuntu/mediawiki@1:1.43.8+dfsg-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:1.43.3+dfsg-1",
        "1:1.43.5+dfsg-1",
        "1:1.43.6+dfsg-2",
        "1:1.43.8+dfsg-1",
        "1:1.43.8+dfsg-2"
      ]
    }
  ],
  "aliases": [],
  "details": "Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user\u0027s browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3.",
  "id": "UBUNTU-CVE-2026-52854",
  "modified": "2026-08-20T00:00:00Z",
  "published": "2026-08-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-52854"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-52854"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/ProfessionalWiki/Maps/pull/899"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-52854"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-52854 (GCVE-0-2026-52854)

FKIE_CVE-2026-52854

GHSA-4H7G-5542-V3FC

Summary

Details

PoC

Impact

ubuntu-cve-2026-52854

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature