Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

wikimedia/mediawiki

              master @ 39433d2
            

229

Fixes

CVEs

CRITICAL

Peak severity

34.3%

Coverage

Highlights

Auth Bypass: 59 prior fixes. Scrutinize any change in this area.

includes/upload/UploadBase.php: most-fixed (7 issues). Treat as high-risk during review.

158 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Recurring failures to enforce permission checks consistently across authentication, authorization, and group management paths, leading to unauthorized access or privilege changes.

Stored/Reflected XSS: Persistent XSS vectors through attribute injection, CSS in SVG uploads, and client-side message parsing, often bypassing sanitization via regex gaps or missing escaping.

Information Disclosure: Leaks of hidden/suppressed user data, block status, and log entries through API queries, special pages, and log listings due to missing permission checks or incorrect bitmask comparisons.