[MediaWiki] [MediaWiki-announce] MediaWiki Extensions and Skins Security Release Supplement (1.43.7/1.44.4/1.45.2)

Produit : MediaWiki

Type : Release / Sécurité

CVE : CVE-2026-5762, CVE-2026-39838, CVE-2026-39839, CVE-2026-39840, CVE-2026-39841, CVE-2026-39837, CVE-2026-22711, CVE-2026-39937, CVE-2026-39933, CVE-2026-39934, CVE-2026-39935, CVE-2026-39936, CVE-2026-30977

Date source : 09/04/2026 15:36

Résumé :
Greetings-

With the security/maintenance release of MediaWiki 1.43.7/1.44.4/1.45.2, we
would also like to provide this supplementary announcement of MediaWiki
extensions and skins with now-public Phabricator tasks, security patches
and backports [1]:

ReportIncident
+ (T414582, CVE-2026-5762) – ReportIncident DiscussionTools integration
causes slow requests with occasional timeouts on large talk pages
https://gerrit.wikimedia.org/r/q/I05d7f65c57d9aa1b70cdb159c4291ac28c60b4dd

ProofreadPage
+ (T406088, CVE-2026-39838) – ProofreadPage improperly sanitizes multiline
styles using Sanitizer::checkCSS
https://gerrit.wikimedia.org/r/q/Idd51e18479b32b7176b43ff74ca1c49d6bdd0628

Cargo
+ (T416271, CVE-2026-39839) – Stored XSS through URLs in Cargo's map format
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1237957
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/12

Action recommandée :
Vérifier la version installée et appliquer le correctif si le produit est concerné.

Source : Voir l’annonce officielle