CVE-2026-100376
Description
A flaw was found in the MediaWiki TemplateSandbox extension. A remote attacker could exploit this vulnerability by enticing a victim into previewing a page configured with a specially crafted sandbox prefix. This flaw can lead to Cross-Site Scripting (XSS), enabling the execution of arbitrary script code within the victim's browser session and potentially compromising their account or session information.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
Disable the TemplateSandbox extension in the MediaWiki installation.
1. Edit the MediaWiki configuration file (typically `LocalSettings.php`) and comment out or remove the extension load line:
php
# wfLoadExtension( 'TemplateSandbox' );
2. Reload or restart the underlying web server or PHP service to apply changes:
bash
systemctl restart php-fpm httpd
Caveats:
Disabling this extension eliminates the ability for wiki editors to preview templates within sandbox namespaces. Restarting the web server or PHP service will momentarily interrupt active web requests.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
