CVE-2023-3550: Debian Linux

High severity, CVSS 7.3. EPSS: 1.4% chance of exploitation in the next 30 days.

Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Mediawiki Mediawiki: version 1.40.0 only

Published 2023-09-25. Last modified 2026-06-17.