CVE-2026-0669: Path Traversal vulnerability in CSS extension on certain web servers
Published Jan 7, 2026
·Updated
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.
Affected Software
5 affected components
Wikimedia Foundation MediaWiki - CSS extension>=1.39<=1.44
All of the following
Css Project Css Mediawiki
Any of the following
MediaWiki MediaWiki=1.39.0
MediaWiki MediaWiki=1.43.0
MediaWiki MediaWiki=1.44.0
Remediation
Event History
Jan 7, 2026
CVE Published
via MITRE·05:46 PM
Data Sourced
via MITRE·05:46 PM
DescriptionWeakness
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-0669?
CVE-2026-0669 is classified as a medium severity vulnerability due to the potential for path traversal attacks.
2
How do I fix CVE-2026-0669?
To fix CVE-2026-0669, update the MediaWiki - CSS extension to version 1.45 or later.
3
What versions of MediaWiki - CSS extension are affected by CVE-2026-0669?
CVE-2026-0669 affects MediaWiki - CSS extension versions 1.39 through 1.44.
4
What type of vulnerability is CVE-2026-0669?
CVE-2026-0669 is a Path Traversal vulnerability that allows unauthorized access to directories.
5
Who is affected by CVE-2026-0669?
Users of the Wikimedia Foundation MediaWiki - CSS extension running affected versions are at risk from CVE-2026-0669.