CVE-2026-52854

{
  "id": "CVE-2026-52854",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T22:16:53.470",
  "lastModified": "2026-10-22T17:09:59.477",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3."
    },
    {
      "lang": "es",
      "value": "Maps es una extensión de MediaWiki que permite la visualización de datos geográficos a través de mapas dinámicos incrustados. Antes de la versión 12.1.3, la función de análisis display_map en el servicio Leaflet acepta HTML controlado por el atacante en el parámetro overlays, y resources/leaflet/jquery.leaflet.js utiliza el nombre de la superposición como una etiqueta de control de capa de Leaflet sin escaparlo. Un usuario de wiki con permiso de edición puede almacenar wikitexto malicioso que provoca la ejecución de scripts cuando otro usuario previsualiza o ve el mapa afectado. El script se ejecuta en la sesión del navegador del usuario que lo visualiza y puede acceder a datos o realizar acciones disponibles para ese usuario. Este problema se ha solucionado en la versión 12.1.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ProfessionalWiki",
          "product": "Maps",
          "versions": [
            {
              "version": "< 12.1.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T18:33:46.350742Z",
          "id": "CVE-2026-52854",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ProfessionalWiki/Maps/pull/899",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}