Produit : MediaWiki
Type : Release / Sécurité
CVE : CVE-2026-103046, CVE-2026-103044, CVE-2026-103045, CVE-2026-103047, CVE-2026-103048, CVE-2026-103049, CVE-2026-103050, CVE-2026-103051, CVE-2026-100237, CVE-2026-100238, CVE-2026-100240, CVE-2026-100241, CVE-2026-100242, CVE-2026-59933, CVE-2026-100243, CVE-2026-100244, CVE-2026-100245, CVE-2026-102796, CVE-2026-100382, CVE-2026-100376, CVE-2026-100378, CVE-2026-100381, CVE-2026-100380, CVE-2026-100377, CVE-2026-100383, CVE-2026-100379, CVE-2026-96872, CVE-2026-96873, CVE-2026-96874, CVE-2026-96875, CVE-2026-96876, CVE-2026-96877, CVE-2026-96878, CVE-2026-96879, CVE-2026-77616, CVE-2026-77610, CVE-2026-77609, CVE-2026-77608, CVE-2026-77607, CVE-2026-77606, CVE-2026-103441, CVE-2026-103442, CVE-2026-103443, CVE-2026-103444, CVE-2026-103445, CVE-2026-103446, CVE-2026-103437, CVE-2026-103438, CVE-2026-103439, CVE-2026-103440, CVE-2026-103584, CVE-2026-103585
Date source : 01/10/2026 16:37
Résumé :
Greetings-
With the security/maintenance release of MediaWiki 1.43.10/1.45.5/1.46.1,
we would also like to provide this supplementary announcement of MediaWiki
extensions and skins with now-public Phabricator tasks, security patches
and backports [1]:
WikiLambda
+ (T428829, CVE-2026-103046) – WikifunctionsFragmentRenderer does unsafe
string replacements on user-provided HTML
https://gerrit.wikimedia.org/r/c/1307827
EasyTimeline
+ (T428006, CVE-2026-103044) – EasyTimeline should not serve image maps as
application/xml
https://gerrit.wikimedia.org/r/c/1346078
Refreshed
+ (T268377, CVE-2026-103045) – XSS in RefreshedTemplate
https://gerrit.wikimedia.org/r/c/1309277
CentralAuth
+ (T244682, CVE-2026-103047) – i18n message that is not in
$wgRawHtmlMessages unsafely used in CentralAuth in uncommon configuration
https://gerrit.wikimedia.org/r/c/1309285
Collection
+ (T321092, CVE-2026-10304
Action recommandée :
Vérifier la version installée et appliquer le correctif si le produit est concerné.
Source : Voir l’annonce officielle