Answer in brief
CVE-2026-52854 records a High severity vulnerability in mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function. The current sources do not mark it as known exploited. The current feed maps mediawiki/maps (composer), ProfessionalWiki/Maps (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps mediawiki/maps (composer), ProfessionalWiki/Maps (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| mediawiki/mapscomposer | <12.1.3 | 12.1.3 |
| ProfessionalWiki/Mapsgeneric | < 12.1.3 | Not reported |
Published upstream
Aug 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 2, 2026
Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fixed in version 12.1.3.
Quoted source text, attributed separately from HOL analysis.