I would like to announce the release of MediaWiki 1.43.9, 1.44.6 and 1.45.4!
These releases serve as security and maintenance releases for these branches.
The tarballs have already been uploaded as of this email, and the git tags have been pushed.
A "MediaWiki Extensions Security Release Supplement" e-mail will follow this one, covering security updates for non-bundled extensions.
Reports of bugs with PHP 8.1 to 8.5 support are particularly welcome, and fixes will be back-ported when possible. If you find issues that haven't been backported, please report these too, referring to the relevant supported release.
PHP 8.x workboards: * https://phabricator.wikimedia.org/tag/php_8.1_support/ * https://phabricator.wikimedia.org/tag/php_8.2_support/ * https://phabricator.wikimedia.org/tag/php_8.3_support/ * https://phabricator.wikimedia.org/tag/php_8.4_support/ * https://phabricator.wikimedia.org/tag/php_8.5_support/
As a reminder, MediaWiki 1.39 became EOL in December 2025 and MediaWiki 1.42 became EOL in June 2025.
MediaWiki 1.44 becomes EOL at the end of July 2026.
MediaWiki 1.46 is due to be released following this security release.
== Security fixes ==
=== MediaWiki Core ===
T422244 - LogItem RCE
When importing log entries (a right only given to sysops by default), due to insecure deserialization, it is possible to use a specially crafted XML file to trigger both arbitrary file write vulnerability (if insecure file permissions allow [3]) and also a Remote Code Execution vulnerability in MediaWiki core.
After upgrading, you can remove these lines from your LocalSettings.php:
$wgRevokePermissions['*']['importupload'] = true; $wgRevokePermissions['*']['import'] = true;
* (T425406, CVE-2026-58036) SECURITY: Fix ApiQueryUsers leaking status of private user conditions for user. * (T422306, CVE-2026-58028) SECURITY: Disallow user JS in pretty-print api.php responses. * (T427235, CVE-2026-58033) SECURITY: Exclude rev-deleted usernames from distinct authors query. * (T426867, CVE-2026-58032) SECURITY: mw.Api.getErrorMessage: Treat formatversion=1 as text. * (T299359, CVE-2026-58026) SECURITY: Make sure the actual title that's being transcluded is includable. * (T422085, CVE-2026-58024) SECURITY: Restrict interwiki user lookup in ApiUserrights. * (T422676, CVE-2026-58029) SECURITY: Check for editmyprivateinfo right in more places. * (T422995, CVE-2026-58037) SECURITY: LogFormatter: 'raw' parameter format is no longer raw HTML. * (T422244, CVE-2026-58025) SECURITY: Safely unserialize log entry parameters.
=== AbuseFilter ===
* (T406954, CVE-2026-58027) SECURITY: Hide hit count for private/protected filters in API.
=== SyntaxHighlight_GeSHi ===
* (T427167, CVE-2026-58030) SECURITY: Escape linelinks argument before passing it on to Pygments.
=== Timeline ===
As per the pre-release email, while it is not bundled with the release, the Timeline issues are included because it is used by Wikimedia wikis and is also widely used across the MediaWiki installation ecosystem.
You can re-enable the extension after you have updated the extension.
Non-bundled extension security issues:
T426631 - RCE
A Remote Code Execution vulnerability exists in the perl script that EasyTimeline executes to render the timelines.
If you run EasyTimeline in a similar fashion to Wikimedia Production, where EasyTimeline’s perl scripts are executed in a remote shellbox (vm or kubernetes), exposure is more limited.
T427611 - Stored XSS in SVG file output
It is possible to store an XSS in the SVG files generated by timeline. These aren’t used by MediaWiki by default (though they may be used for RTL timelines), but these files would still be hosted by your wiki, and could be hot linked elsewhere.
* (T426631, CVE-2026-8857) SECURITY: EasyTimeline: Harden against script injection via TextData. * (T426631, CVE-2026-8857) SECURITY: EasyTimeline: Strip newlines from BarData and Scale text. * (T427611, CVE-2026-58038) SECURITY: Run timeline generated SVG through MW upload checks.
== Links to all mentioned tasks ==
* https://phabricator.wikimedia.org/T299359 * https://phabricator.wikimedia.org/T406954 * https://phabricator.wikimedia.org/T422085 * https://phabricator.wikimedia.org/T422244 * https://phabricator.wikimedia.org/T422306 * https://phabricator.wikimedia.org/T422676 * https://phabricator.wikimedia.org/T422995 * https://phabricator.wikimedia.org/T425406 * https://phabricator.wikimedia.org/T426631 * https://phabricator.wikimedia.org/T426867 * https://phabricator.wikimedia.org/T427167 * https://phabricator.wikimedia.org/T427235 * https://phabricator.wikimedia.org/T427611
== Release notes ==
Full release notes for 1.43.9: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_43/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.43
Full release notes for 1.44.6: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_44/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.44
Full release notes for 1.45.4: https://phabricator.wikimedia.org/diffusion/MW/browse/REL1_45/RELEASE-NOTES-... https://www.mediawiki.org/wiki/Release_notes/1.45
For information about how to upgrade, see https://www.mediawiki.org/wiki/Manual:Upgrading
********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.9.tar.gz https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.9.zip
Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.9.tar.gz https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.9.zip
Patch to previous version (1.43.8): https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.9.patch.gz https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.9.patch.zip
GPG signatures: https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.9.tar.gz.s... https://releases.wikimedia.org/mediawiki/1.43/mediawiki-core-1.43.9.zip.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.9.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.9.zip.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.9.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.43/mediawiki-1.43.9.patch.zip.sig
Public keys: https://www.mediawiki.org/keys/keys.html
********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.6.tar.gz https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.6.zip
Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.6.tar.gz https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.6.zip
Patch to previous version (1.44.5): https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.6.patch.gz https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.6.patch.zip
GPG signatures: https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.6.tar.gz.s... https://releases.wikimedia.org/mediawiki/1.44/mediawiki-core-1.44.6.zip.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.6.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.6.zip.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.6.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.44/mediawiki-1.44.6.patch.zip.sig
Public keys: https://www.mediawiki.org/keys/keys.html
********************************************************************** Download: https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.4.tar.gz https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.4.zip
Download without bundled extensions: https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.4.tar.gz https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.4.zip
Patch to previous version (1.45.3): https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.4.patch.gz https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.4.patch.zip
GPG signatures: https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.4.tar.gz.s... https://releases.wikimedia.org/mediawiki/1.45/mediawiki-core-1.45.4.zip.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.4.tar.gz.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.4.zip.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.4.patch.gz.sig https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.4.patch.zip.sig
Public keys: https://www.mediawiki.org/keys/keys.html