MediaWiki-l September 2026

mediawiki-l@lists.wikimedia.org

7 participants
5 discussions

Major security issue for External Data extension; upgrade or disable immediately
by Yaron Koren 27 Sep '26

27 Sep '26

Hello, One of my extensions, External Data, has, since version 3.0 in 2021, allowed for running local applications on the wiki's server and displaying their results. This was probably a mistake, but it fortunately didn't cause problems until recently, when a security vulnerability was discovered that allows for outside users to use External Data in order to run arbitrary commands on the wiki's server. It was already fixed a little while ago, but it was only publicized two days ago, and soon after that someone started to aggressively go after wikis that have External Data installed, creating new files on those servers and doing who knows what else. If you have Exernal Data installed on your wiki, I strongly recommend either upgrading to the latest version, 3.7 - which fixes this known vulnerability - or simply disabling External Data altogether. This should really be done as soon as possible. Also, if you have/had an earlier version of External Data installed when this security leak was publicized, you should consider the possibility that any secret information on your server has now been discovered - database passwords, etc. - and change them as soon as you can. Also please look for any files that may have been added recently and seem suspect - they are most likely the result of hackers. I plan to get rid of the ability to run local programs in External Data, because the whole thing is too fraught with risk. I am extremely sorry about this problem, and I hope the damage can be mitigated. -Yaron -- WikiWorks · MediaWiki Consulting · http://wikiworks.com

2 2

MediaWiki Language Extension Bundle 2026.09
by Kartik Mistry 16 Sep '26

16 Sep '26

We would like to announce the release of MediaWiki Language Extension Bundle 2026.09. This bundle is compatible with *MediaWiki 1.46.0*. It requires *PHP >= 8.3.0*. The next MLEB is expected to be released 6 months after the *MediaWiki 1.47 release*. If there are important bug fixes, we will do an intermediate release. Please give us your feedback at https://www.mediawiki.org/wiki/Talk:MLEB. - Download: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2026.09.tar… - sha256sum: c854e060e6cbaa6ff8c55ed63f59f94a6b8aaaf810813f2a14734b221a50a605 - Signature: https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2029 .02.tar.bz2.asc <https://translatewiki.net/mleb/MediaWikiLanguageExtensionBundle-2026.09.tar…> *Highlights* - UniversalLanguageSelector: Enable the new redesigned language selector by default on Vector 2022 and Minerva. Full release notes are available at: https://www.mediawiki.org/wiki/MediaWiki_Language_Extension_Bundle/2026.09 *Quick links* - Installation instructions are at: https://www.mediawiki.org/wiki/MLEB - Announcements of new releases will be posted to a mailing list: https://lists.wikimedia.org/postorius/lists/mediawiki-i18n.lists.wikimedia.… - Report bugs to: https://phabricator.wikimedia.org/project/view/1464

1 0

MediaWiki MCP Server: connect AI tools such as Claude to your wiki
by Jeroen De Dauw 08 Sep '26

08 Sep '26

Hi all, We are pleased to announce the MediaWiki MCP Server, our free and open-source connector for integrating AI tools with MediaWiki. MCP stands for Model Context Protocol and is the standard that AI tools such as Claude and ChatGPT use to reach external data and tools. You can now point such AI tools at your wiki via the MediaWiki MCP server. This lets you work on your wiki in plain language instead of clicking through special pages or writing API scripts. For example: "Create a vendor page for each row in this spreadsheet, using the Vendor template." The MediaWiki MCP Server enables you to: * Read and search: fetch pages, files, revisions, and history, search titles and full text, render wikitext without saving, and diff any two revisions * Create and edit: create pages, edit or append individual sections, move, delete and undelete pages, and upload files * Explore: follow what links to a page, browse category members, and track recent changes * Query structured data: #ask queries and property discovery for Semantic MediaWiki, Cargo and Bucket queries, Wikibase support, and schema-aware reads and writes for NeoWiki * Work with several wikis at once. Great for moving content from one wiki to another You can use the MCP server without installing anything on your wiki, since it communicates with the standard MediaWiki API. For edits, the MCP server signs you in through your browser with OAuth 2.0. On wikis without Extension:OAuth, you can use a bot password instead. If you would rather not run it yourself, we also offer it as a hosted add-on on our MediaWiki hosting, where your team connects with a single URL. Overview and installation: https://professional.wiki/en/mediawiki-mcp-server Source, full tool reference, and configuration docs: https://github.com/ProfessionalWiki/MediaWiki-MCP-Server (already over 100 stars 🚀) Walkthrough with a short demo video, using Semantic MediaWiki: https://professional.wiki/en/news/semantic-mediawiki-with-ai Feedback and contributions welcome! Best -- Jeroen De Dauw | CEO Professional Wiki <https://www.Professional.Wiki> Sovereign knowledge infrastructure: knowledge graphs, optional AI, open source NeoWiki <https://neowiki.ai/> | AI Assistant <https://professional.wiki/en/mediawiki-ai-assistant> | MediaWiki Hosting <https://professional.wiki/en/hosting> | Wiki Services <https://professional.wiki/en/services> Professional Wiki GmbH, Tieckstraße 24, 10115 Berlin Geschäftsführung: Jeroen De Dauw, Karsten Hoffmeyer Handelsregister: Amtsgericht Charlottenburg, HRB 246887 B Sitz: Berlin, USt-IdNr.: DE356328845

1 0

MediaWiki 1.47-alpha will be branched as a beta on 12th October 2026
by Mateus Santos 07 Sep '26

07 Sep '26

Hey all, This is a quick note to highlight that in five weeks' time, the REL1_47 branch will be created for MediaWiki core and each of the extensions and skins in Wikimedia git, with some (the 'tarball') included as sub-modules of MediaWiki itself[0]. This is the first step in the release process for MediaWiki 1.47, which should be out in November 2026, approximately six months after MediaWiki 1.46. The branches will reflect the code as of the last 'alpha' branch for the release, 1.47.0-wmf.24, which will be deployed to Wikimedia wikis in the week beginning 12 October 2026 for MediaWiki itself and those extensions and skins available there. After that point, patches that land in the main development branch of MediaWiki and its bundled extensions and skins will be instead be slated for the MediaWiki 1.48 release unless specifically backported[1]. If you are working on a new feature that you wish to land for the release, you now have a few days to finish your work and land it in the development branch; feature changes should not be backported except in an urgent case. If your work might not be complete in time, and yet should block release for everyone else, please file a task against the `mw-1.47-release` project on Phabricator.[2] If you have tickets that are already tagged for `mw-1.47-release`, please finish them, untag them, or reach out to get them resolved in the next few weeks. We hope to issue the first release candidate, 1.47.0-rc.0, three weeks after the branch point, and if all goes well, to release MediaWiki 1.47.0 a few weeks after that in late November. [0]: <https://www.mediawiki.org/wiki/Bundled_extensions_and_skins> [1]: <https://www.mediawiki.org/wiki/Backporting_fixes> [2]: <https://phabricator.wikimedia.org/tag/mw-1.47-release/>

1 0

Get URLs from externallinks table
by MI 01 Sep '26

01 Sep '26

I'm trying to get a list of all external links in our wiki (version 1.43.3, with a PostgreSQL DB v. 15.14). The links are in the externallinks table, split into the "el_to_domain_index" and "el_to_path" fields. But the el_to_domain_index column is reversed, so this doesn't work: SELECT page_title, el_to_domain_index, el_to_path, CONCAT(el_to_domain_index, el_to_path) AS bad_link FROM page JOIN externallinks ON page.page_id = externallinks.el_id WHERE page_is_redirect=0 AND page_namespace=0 AND el_to_domain_index LIKE 'http%' ORDER BY page_title; This gives for example FFV1, https://*org.ffmpeg.trac.*, /wiki/Encode/FFV1, https://*org.ffmpeg.trac.*/wiki/Encode/FFV1 But the link should of course be https://*trac.ffmpeg.org*/wiki/Encode/FFV1 Is there an SQL trick to restore the order of el_to_domain_index to get the correct URL? Thanks, MI

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

MediaWiki-l September 2026