Hi all,
On Monday (2026-06-29) we will be issuing a security and maintenance
release to all supported branches of MediaWiki.
Due to the complexity of various patches that will be released as part of
this, they will be made public in Gerrit before the tarballs and git tags
are made.
We have therefore referenced mitigations for some high severity issues both
in the referenced tickets and below.
It is strongly recommended to apply the mitigations to your MediaWiki
installs ASAP, before the patches are released.
While Timeline/EasyTimeline[2] is *not* a MW Bundled extension, it is used
on Wikimedia wikis and is also widely used across the MediaWiki
installation ecosystem; it is therefore flagged for your attention due to
the issues found. If you do not have this extension installed, you do not
need to do anything for that mitigation.
The new releases will be:
- 1.43.9
- 1.44.6
- 1.45.4
These security issues will also be included in 1.46.0, which is due to be
released afterwards.
Security issues:
MediaWiki Core: https://phabricator.wikimedia.org/T422244 - RCE
Mitigation patch:
Making use of $wgRevokePermissions [4], the following lines can be added to
your LocalSettings.php; it will temporarily disable all importing and
therefore prevent malicious files being imported by any user:
$wgRevokePermissions['*']['importupload'] = true;
$wgRevokePermissions['*']['import'] = true;
You will want to remove these lines once you have applied the security
patches/upgraded to the latest point release versions. We recommend that
you restrict imports to trusted users.
Non-bundled extension security issues:
Timeline: https://phabricator.wikimedia.org/T426631 - RCE
A Remote Code Execution vulnerability exists in the perl script that
EasyTimeline executes to render the timelines.
If you run EasyTimeline in a similar fashion to Wikimedia Production, where
EasyTimeline’s perl scripts are executed in a remote shellbox (vm or
kubernetes), exposure is more limited.
Mitigation: Disable timeline (EasyTimeline) extension until patches are
released, especially if you do not run the execution in a remote shellbox.
Or if you have access to the security tasks, apply the patch from the task.
Timeline: https://phabricator.wikimedia.org/T427611 - Stored XSS in SVG
file output
It is possible to store an XSS in the SVG files generated by timeline.
These aren’t used by MediaWiki by default (though they may be used for RTL
timelines), but these files would still be hosted by your wiki, and could
be hot linked elsewhere.
Mitigation: Disable timeline (EasyTimeline) extension until patches are
released, especially if you do not run the execution in a remote shellbox.
Or if you have access to the security tasks, apply the patch from the task.
Appropriate CSP configuration can also help prevent XSS vectors such as
this.
—
This release will also resolve security issues in bundled extensions, along
with bug fixes included for maintenance reasons.
These security issues also affect many unsupported versions of MediaWiki.
We will make the fixes available in the respective release branches and
master in git. Tarballs will be available for the above mentioned point
releases as well.
A summary of some of the security fixes that have gone into non-bundled
MediaWiki extensions will also follow later.
As a reminder, MediaWiki 1.39 became EOL in December 2025 and MediaWiki
1.42 became EOL in June 2025.
MediaWiki 1.44 becomes EOL at the end of July 2026.
MediaWiki 1.46 is due to be released following this security release.
More information on these timelines can be viewed on the version lifecycle
page at [1].
Thank you,
Wikimedia Foundation, Product Safety and Integrity
security-help(a)wikimedia.org
[1] https://www.mediawiki.org/wiki/Version_lifecycle
[2] https://www.mediawiki.org/wiki/Extension:EasyTimeline
[3] https://www.mediawiki.org/wiki/Manual:Security#File_permissions
[4] https://www.mediawiki.org/wiki/Manual:$wgRevokePermissions
Hey all,
This is a quick note to highlight that we've created the REL1_46 branch for
MediaWiki core and each of the extensions and skins in Wikimedia git [0].
This is the first step in the release process for MediaWiki 1.46.0, which
should be out in June 2026, approximately six months after MediaWiki 1.45.0.
The branches reflect the code as of the last 'alpha' branch for the
release, 1.46.0-wmf.26, which was deployed to Wikimedia wikis on Tuesday,
28th April, for MediaWiki itself and those extensions and skins available
there.
From now on, patches that land in the main development branch of MediaWiki
and its bundled extensions and skins will be slated for the MediaWiki 1.47
release, unless specifically backported [1].
If you are working on a critical bug fix that will affect the code in the
release, once the patch has been merged into the development branch, you
should propose it for backporting by cherry-picking to the REL1_46 branch.
If you are working on a new feature, that should now not be backported. If
you have an urgent case where the work should block release for everyone
else, please file a task against the `mw 1.46-release` project on
Phabricator [2].
If you have tickets that are tagged for `mw-1.46-release`, please finish
them, untag them, or reach out to get them resolved in the next few days.
We hope to issue the first release candidate, 1.46.0-rc.0, in roughly three
weeks' time, and if all goes well, to then release MediaWiki 1.46.0 a few
weeks after that.
[0]: https://www.mediawiki.org/wiki/Bundled_extensions_and_skins
[1]: https://www.mediawiki.org/wiki/Backporting_fixes
[2]: https://phabricator.wikimedia.org/tag/mw-1.46-release/
Hey all, apologies for the previous email with incorrect dates and title.
This is a quick note to highlight that in the week of 21st of April 2026,
the REL1_46
branch will be created for MediaWiki core and each of the extensions and
skins in Wikimedia git, with some (the 'tarball') included as sub-modules
of MediaWiki itself[0]. This is the first step in the release process for
MediaWiki 1.46, which should be out in June 2026, approximately six months
after MediaWiki 1.45.
The branches will reflect the code as of the last 'alpha' branch for the
release, 1.46.0-wmf.25, which will be deployed to Wikimedia wikis in the
week beginning 21 April 2026 for MediaWiki itself and those extensions
and skins available there.
After that point, patches that land in the main development branch of
MediaWiki and its bundled extensions and skins will be instead be slated
for the MediaWiki 1.47 release unless specifically backported[1].
If you are working on a new feature that you wish to land for the release,
you now have a few days to finish your work and land it in the development
branch; feature changes should not be backported except in an urgent case.
If your work might not be complete in time, and yet should block release
for everyone else, please file a task against the `mw-1.46-release` project
on Phabricator.[2]
If you have tickets that are already tagged for `mw-1.46-release`, please
finish them, untag them, or reach out to get them resolved in the next few
weeks.
We hope to issue the first release candidate, 1.46.0-rc.0, two weeks after
the branch point, and if all goes well, to release MediaWiki 1.46.0 a few
weeks after that in the beginning of June.
[0]: <https://www.mediawiki.org/wiki/Bundled_extensions_and_skins>
[1]: <https://www.mediawiki.org/wiki/Backporting_fixes>
[2]: <https://phabricator.wikimedia.org/tag/mw-1.46-release/>
Hey all,
This is a quick note to highlight that in the week of 21st of April
2026, the REL1_46
branch will be created for MediaWiki core and each of the extensions and
skins in Wikimedia git, with some (the 'tarball') included as sub-modules
of MediaWiki itself[0]. This is the first step in the release process for
MediaWiki 1.46, which should be out in June 2024, approximately six months
after MediaWiki 1.45.
The branches will reflect the code as of the last 'alpha' branch for the
release, 1.46.0-wmf.25, which will be deployed to Wikimedia wikis in the
week beginning 21 April 2024 for MediaWiki itself and those extensions
and skins available there.
After that point, patches that land in the main development branch of
MediaWiki and its bundled extensions and skins will be instead be slated
for the MediaWiki 1.47 release unless specifically backported[1].
If you are working on a new feature that you wish to land for the release,
you now have a few days to finish your work and land it in the development
branch; feature changes should not be backported except in an urgent case.
If your work might not be complete in time, and yet should block release
for everyone else, please file a task against the `mw-1.46-release` project
on Phabricator.[2]
If you have tickets that are already tagged for `mw-1.46-release`, please
finish them, untag them, or reach out to get them resolved in the next few
weeks.
We hope to issue the first release candidate, 1.46.0-rc.0, two weeks after
the branch point, and if all goes well, to release MediaWiki 1.46.0 a few
weeks after that in the beginning of June.
[0]: <https://www.mediawiki.org/wiki/Bundled_extensions_and_skins>
[1]: <https://www.mediawiki.org/wiki/Backporting_fixes>
[2]: <https://phabricator.wikimedia.org/tag/mw-1.46-release/>