CVE-2026-52854

Summary

mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function

Severity

high

CVSS

8.6

EPSS

0.6% (p49)

CWE

CWE-79, CWE-80

Also known as

GHSA-4h7g-5542-v3fc

Published

2026-07-02

Updated

2026-07-02

Advisory details

Summary

Stored XSS through wikitext can be performed by inserting malicious HTML into the overlays parameter of the display_map parser function when using the leaflet service.

Details

The maps extension doesn't escape overlay names before passing them to leaflet. Leaflet then inserts them as HTML: https://github.com/ProfessionalWiki/Maps/blob/ca5139fabd75f3c34f47ea3fd161306506b053bc/resources/lib/leaflet/leaflet.js#L5243

PoC

Preview the following wikitext, using the default configuration options of the extension:

{{#display_map:0,0|service=leaflet|overlays=OpenTopoMap.<img src=x onerror="alert(1);">}}

Impact

Stored XSS can be performed by any user with the edit permission.

References

• https://github.com/advisories/GHSA-4h7g-5542-v3fc
• https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc

Related advisories

• CVE-2026-55696 — medium · Packagist/privatebin/privatebin
• CVE-2026-52816 — medium · Go/gogs.io/gogs
• CVE-2026-85061 — critical · npm/maplibre-gl
• CVE-2026-52881 — critical · Packagist/mantisbt/mantisbt
• CVE-2026-52847 — critical · Packagist/mantisbt/mantisbt
• CVE-2026-50551 — critical · Go/github.com/siyuan-note/siyuan/kernel
• CVE-2026-54158 — critical · Go/github.com/siyuan-note/siyuan/kernel
• CVE-2026-54067 — critical · Go/github.com/siyuan-note/siyuan/kernel

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity