CVE-2026-103441: Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing
Published Sep 30, 2026
·Updated
Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files.
This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.
Affected Software
1 affected component
Wikimedia Foundation MediaWiki Wikibase Extension=1.46, =1.45, =1.43
Event History
Sep 30, 2026
CVE Published
via MITRE·03:59 PM
Data Sourced
via MITRE·03:59 PM
DescriptionWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments should be checked for exposure?
Check installations of the Wikimedia Foundation MediaWiki Wikibase extension running version 1.46, 1.45, or 1.43. The provided information does not identify affected patch-level releases within those version lines.
2
What access and conditions does exploitation require?
The CVSS vector indicates network reachability, low attacker privileges, user interaction, high attack complexity, and an additional attack requirement. The supplied data does not specify the exact privilege, interaction, or configuration conditions involved.