bombobombone/cve-2026-96875Report and proof-of-concept script for CVE-2026-96875, a reflected XSS in MediaWiki Cargo Drilldown hierarchy filters, with validation notes and upstream fix references.
Reporter: Marco Paciaroni (BomboBombone).
Cargo did not preserve escaping when formatting a hierarchy-filter value for the Drilldown breadcrumb. Request data could be interpreted as HTML in the resulting page.
The CVE record identifies Cargo through 3.9.4 as affected.
The reported scenario required a public Cargo table with a hierarchy field. An anonymous attacker could prepare a request for a victim to open, resulting in script execution in the wiki origin.
The original report records browser execution from the reflected filter display on a local MediaWiki instance. An ordinary filter value rendered as text.
The upstream change removes entity decoding from formatted filter output and adjusts message handling to preserve the intended text boundary.
python poc.py https://wiki.example TABLE FIELD
The script sends the hierarchy-filter request with a harmless DOM marker and reports whether the response contains an unescaped image element.
The public CVE description currently labels this issue stored XSS. The submitted report describes a request value reflected in the response. This report describes that observed behavior without changing the CVE record.