CVE-2026-52854

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-52854", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-08T18:41:27.724Z", "datePublished": "2026-08-18T21:32:09.253Z", "dateUpdated": "2026-08-19T18:33:53.281Z"}, "containers": {"cna": {"title": "mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-80", "lang": "en", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"}, {"name": "https://github.com/ProfessionalWiki/Maps/pull/899", "tags": ["x_refsource_MISC"], "url": "https://github.com/ProfessionalWiki/Maps/pull/899"}, {"name": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806", "tags": ["x_refsource_MISC"], "url": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806"}, {"name": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md", "tags": ["x_refsource_MISC"], "url": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md"}, {"name": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3"}], "affected": [{"vendor": "ProfessionalWiki", "product": "Maps", "versions": [{"version": "< 12.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T21:32:09.253Z"}, "descriptions": [{"lang": "en", "value": "Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3."}], "source": {"advisory": "GHSA-4h7g-5542-v3fc", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T18:33:46.350742Z", "id": "CVE-2026-52854", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:33:53.281Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-52854", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T18:33:46.350742Z"}}}], "references": [{"url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T18:33:31.159Z"}}], "cna": {"title": "mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function", "source": {"advisory": "GHSA-4h7g-5542-v3fc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ProfessionalWiki", "product": "Maps", "versions": [{"status": "affected", "version": "< 12.1.3"}]}], "references": [{"url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc", "name": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ProfessionalWiki/Maps/pull/899", "name": "https://github.com/ProfessionalWiki/Maps/pull/899", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806", "name": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md", "name": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3", "name": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-80", "description": "CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T21:32:09.253Z"}}}, "cveMetadata": {"cveId": "CVE-2026-52854", "state": "PUBLISHED", "dateUpdated": "2026-08-19T18:33:53.281Z", "dateReserved": "2026-06-08T18:41:27.724Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T21:32:09.253Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Maps", "vendor": "ProfessionalWiki", "versions": [{"status": "affected", "version": "< 12.1.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3."}, {"lang": "es", "value": "Maps es una extensi\u00f3n de MediaWiki que permite la visualizaci\u00f3n de datos geogr\u00e1ficos a trav\u00e9s de mapas din\u00e1micos incrustados. Antes de la versi\u00f3n 12.1.3, la funci\u00f3n de an\u00e1lisis display_map en el servicio Leaflet acepta HTML controlado por el atacante en el par\u00e1metro overlays, y resources/leaflet/jquery.leaflet.js utiliza el nombre de la superposici\u00f3n como una etiqueta de control de capa de Leaflet sin escaparlo. Un usuario de wiki con permiso de edici\u00f3n puede almacenar wikitexto malicioso que provoca la ejecuci\u00f3n de scripts cuando otro usuario previsualiza o ve el mapa afectado. El script se ejecuta en la sesi\u00f3n del navegador del usuario que lo visualiza y puede acceder a datos o realizar acciones disponibles para ese usuario. Este problema se ha solucionado en la versi\u00f3n 12.1.3."}], "id": "CVE-2026-52854", "lastModified": "2026-10-22T17:09:59.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52854", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T18:33:46.350742Z", "version": "2.0.3"}}]}, "published": "2026-08-18T22:16:53.470", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md"}, {"source": "security-advisories@github.com", "url": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806"}, {"source": "security-advisories@github.com", "url": "https://github.com/ProfessionalWiki/Maps/pull/899"}, {"source": "security-advisories@github.com", "url": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,12.1.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Maps", "source": "cna", "vendor": "ProfessionalWiki"}, "product": "maps", "vendor": "professionalwiki"}], "created": "2026-08-18T22:30:04.517674+00:00", "updated": "2026-08-21T12:31:45.907327+00:00", "vendors": ["professionalwiki", "professionalwiki$PRODUCT$maps"]}