CVE-2026-0669

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0669", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2026-01-07T16:35:00.729Z", "datePublished": "2026-01-07T17:46:57.285Z", "dateUpdated": "2026-01-07T19:21:57.287Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MediaWiki - CSS extension", "repo": "http://gerrit.wikimedia.org/g/mediawiki/extensions/CSS", "vendor": "Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Radman Siddiki"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.<p>This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.</p>"}], "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-07T17:46:57.285Z"}, "references": [{"url": "https://phabricator.wikimedia.org/T401526"}, {"url": "https://gerrit.wikimedia.org/r/q/Ia15bf3f2e5a341868568492a736ac3dbf706c22e"}], "source": {"discovery": "UNKNOWN"}, "title": "Path Traversal vulnerability in CSS extension on certain web servers", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T19:20:56.695860Z", "id": "CVE-2026-0669", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T19:21:57.287Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-0669", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T19:20:56.695860Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T19:21:11.932Z"}}], "cna": {"title": "Path Traversal vulnerability in CSS extension on certain web servers", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Radman Siddiki"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"repo": "http://gerrit.wikimedia.org/g/mediawiki/extensions/CSS", "vendor": "Wikimedia Foundation", "product": "MediaWiki - CSS extension", "versions": [{"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://phabricator.wikimedia.org/T401526"}, {"url": "https://gerrit.wikimedia.org/r/q/Ia15bf3f2e5a341868568492a736ac3dbf706c22e"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.", "supportingMedia": [{"type": "text/html", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.<p>This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2026-01-07T17:46:57.285Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0669", "state": "PUBLISHED", "dateUpdated": "2026-01-07T19:21:57.287Z", "dateReserved": "2026-01-07T16:35:00.729Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2026-01-07T17:46:57.285Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MediaWiki - CSS extension", "repo": "http://gerrit.wikimedia.org/g/mediawiki/extensions/CSS", "vendor": "Wikimedia Foundation", "versions": [{"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}]}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:css_project:css:-:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "931FD1A4-7FD7-41E3-85E2-6B99F5E3BAB5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.39.0:-:*:*:*:*:*:*", "matchCriteriaId": "243E4420-7054-4190-8270-76E09207FC9C", "vulnerable": false}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.43.0:-:*:*:*:*:*:*", "matchCriteriaId": "65A0A018-AEB0-491D-94C4-C14B7D8A45E7", "vulnerable": false}, {"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.44.0:*:*:*:*:*:*:*", "matchCriteriaId": "FB02399E-7A9A-4F8C-8031-F4D4DCD82C76", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39."}, {"lang": "es", "value": "Limitaci\u00f3n Inadecuada de un Nombre de Ruta a un Directorio Restringido (\u2019Salto de Ruta\u2019) vulnerabilidad en la extensi\u00f3n CSS de Wikimedia Foundation MediaWiki permite el salto de ruta. Este problema afecta a la extensi\u00f3n CSS de MediaWiki: 1.44, 1.43, 1.39."}], "id": "CVE-2026-0669", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0669", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T19:20:56.695860Z", "version": "2.0.3"}}]}, "published": "2026-01-07T18:15:53.003", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/q/Ia15bf3f2e5a341868568492a736ac3dbf706c22e"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Exploit", "Issue Tracking"], "url": "https://phabricator.wikimedia.org/T401526"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{"bugzilla": {"description": "MediaWiki: MediaWiki CSS extension: Information disclosure via path traversal", "id": "2427617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427617"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in the MediaWiki CSS extension. This vulnerability, categorized as a Path Traversal, allows a remote attacker to access restricted directories. By manipulating file paths, an attacker can read arbitrary files on the server, potentially leading to the disclosure of sensitive information."], "mitigation": {"lang": "en:us", "value": "To reduce the attack surface, restrict network access to the MediaWiki instance to only trusted clients or internal networks using firewall rules. For example, using `firewalld`, you can limit access to the web server port (e.g., 80 or 443) from specific source IP addresses or zones. This may impact legitimate users if not configured carefully."}, "name": "CVE-2026-0669", "public_date": "2026-01-07T17:46:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-0669\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-0669\nhttps://gerrit.wikimedia.org/r/q/Ia15bf3f2e5a341868568492a736ac3dbf706c22e\nhttps://phabricator.wikimedia.org/T401526"], "statement": "This vulnerability is rated Moderate for Red Hat as it affects MediaWiki, a web application that, if deployed, could allow an unauthenticated attacker to perform path traversal. This could lead to unauthorized access to sensitive files on the server where MediaWiki is hosted.", "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-18T16:50:31.152121+00:00", "value": {"mitigation_remediation": ["Upgrade the MediaWiki CSS extension to the latest patched version or upgrade the entire MediaWiki installation to a release where this issue is fixed.", "Verify that file and directory permissions for the CSS extension and its configuration directories are set to the minimum required for operation.", "Deploy web application firewall rules or server configuration changes that block URLs containing directory traversal patterns such as \"..\" or encoded equivalents."], "summary": {"action": "Patch Immediately", "impact": "Path traversal vulnerability"}, "threat_synthesis": {"affected_systems": "Affected products include the MediaWiki CSS extension versions 1.39, 1.43, and 1.44. The vulnerability is documented for these releases and would impact any MediaWiki installation deploying the CSS extension in these versions. No newer versions are listed as affected.", "description_and_impact": "This vulnerability arises from improper pathname validation in the MediaWiki CSS extension, permitting path traversal. Based on the description, it is inferred that an attacker could construct crafted URLs to reference files outside the intended extension directory. The weakness is identified as CWE\u201122.", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would involve an attacker sending specially crafted requests to the extension directory to bypass pathname restrictions."}}}}, "created": "2026-01-08T09:48:08.479399+00:00", "updated": "2026-04-18T17:00:05.566254+00:00", "vendors": ["mediawiki", "mediawiki$PRODUCT$mediawiki", "wikimedia", "wikimedia$PRODUCT$mediawiki-css_extension"]}