This vulnerability (CVE-2026-58025) in MediaWiki is related to CWE-502 (Deserialization of untrusted data) and affects multiple versions before 1.43.9, 1.44.6, 1.45.4, and 1.46.0. It involves unsafe deserialization in specific PHP files responsible for import and logging functionality. The CVSS 4.0 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and low to high impacts on confidentiality, integrity, availability, and security requirements. The vulnerability is published but lacks an official remediation level or patch information from the vendor.

The vulnerability allows deserialization of untrusted data, which can lead to potential security issues such as code execution or data manipulation. The CVSS score of 5.9 (medium severity) reflects moderate impact with high attack complexity and limited privileges required. There are no known exploits in the wild reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the Wikimedia Foundation advisories for updates. Until a patch is available, avoid processing untrusted data with the affected components if possible.