CVE-2021-44857: Mediawiki

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any public wiki, or a private wiki that has at least one page set in $wgWhitelistRead.

Affected products

• Mediawiki Mediawiki: before 1.35.5 (fixed in 1.35.5); from 1.36.0, before 1.36.3 (fixed in 1.36.3); from 1.37.0, before 1.37.1 (fixed in 1.37.1)

Published 2021-12-17. Last modified 2026-06-17.