CVE-2026-0669

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-0669
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gerrit.wikimedia.org/r/q/Ia15bf3f2e5a341868568492a736ac3dbf706c22e Patch
https://phabricator.wikimedia.org/T401526 Exploit Issue Tracking
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:css_project:css:-:*:*:*:*:mediawiki:*:*
OR cpe:2.3:a:mediawiki:mediawiki:1.39.0:-:*:*:*:*:*:*
cpe:2.3:a:mediawiki:mediawiki:1.43.0:-:*:*:*:*:*:*
cpe:2.3:a:mediawiki:mediawiki:1.44.0:*:*:*:*:*:*:*
History

No history.

Information

Published : 2026-01-07 18:15

Updated : 2026-02-23 18:45

NVD link : CVE-2026-0669

Mitre link : CVE-2026-0669

CVE.ORG link : CVE-2026-0669

JSON object : View

Products Affected

mediawiki

  • mediawiki

css_project

  • css
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')