CVE-2026-52854

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3.

• CWE-79
• CWE-80

• https://github.com/ProfessionalWiki/Maps/blob/12.1.3/RELEASE-NOTES.md
• https://github.com/ProfessionalWiki/Maps/commit/737a993fc2f40499e9bb22198fd1d56c25613806
• https://github.com/ProfessionalWiki/Maps/pull/899
• https://github.com/ProfessionalWiki/Maps/releases/tag/12.1.3
• https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc
• https://github.com/ProfessionalWiki/Maps/security/advisories/GHSA-4h7g-5542-v3fc

Published

Aug 18, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52846Caddy is an extensible server platform that uses TLS by defa…4.2
• CVE-2026-5285Use after free in WebGL in Google Chrome prior to 146.0.7680…8.8
• CVE-2026-52850Docmost is open-source collaborative wiki and documentation …4.3
• CVE-2026-52851Traccar is an open source GPS tracking system. Prior to 6.14…7.1
• CVE-2026-52852Traccar is an open source GPS tracking system. Prior to 6.14…6.5
• CVE-2026-52853Docmost is open-source collaborative wiki and documentation …5.2
• CVE-2026-52855Wings is the server control plane for Pterodactyl, a free, o…9.9
• CVE-2026-52856Wings is the server control plane for Pterodactyl, a free, o…7.5
• CVE-2026-52857Wings is the server control plane for Pterodactyl, a free, o…5.5
• CVE-2026-52858Vim is an open source, command line text editor. Prior to ve…7.8
• CVE-2026-52859Vim is an open source, command line text editor. Prior to ve…8.2
• CVE-2026-5286Use after free in Dawn in Google Chrome prior to 146.0.7680.…8.8