GitHub Advisoryadvisory · Packagist
GHSA-4h7g-5542-v3fc mediawiki/maps has stored XSS through the overlays parameter in the display_map parser function
HIGH
Official page ↗
- Aliases
- CVE-2026-52854
- Ecosystem
- Packagist
- Packages
- mediawiki/maps
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
- Weaknesses
- CWE-79, CWE-80
- Reviewed
- 2026-07-02
Affected packages
• Packagist mediawiki/maps: < 12.1.3 → fixed in 12.1.3
Description
Summary
Stored XSS through wikitext can be performed by inserting malicious HTML into the `overlays` parameter of the `display_map` parser function when using the leaflet service.
Details
The maps extension doesn't escape overlay names before passing them to leaflet.
Leaflet then inserts them as HTML: https://github.com/ProfessionalWiki/Maps/blob/ca5139fabd75f3c34f47ea3fd161306506b053bc/resources/lib/leaflet/leaflet.js#L5243
PoC
Preview the following wikitext, using the default configuration options of the extension:
```
{{#display_map:0,0|service=leaflet|overlays=OpenTopoMap.}}
```
Impact
Stored XSS can be performed by any user with the `edit` permission.
Related
Alias · CVE (1)
- CVE-2026-52854 Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. vulnerability