CVE-2024-23173: Mediawiki

Medium severity, CVSS 6.1. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.

Affected products

• Mediawiki Mediawiki: before 1.35.14 (fixed in 1.35.14); from 1.36.0, before 1.39.6 (fixed in 1.39.6); from 1.40.0, before 1.40.2 (fixed in 1.40.2)

Published 2024-01-12. Last modified 2026-06-17.