AIKIDO-2026-696794

mediawiki/maps is vulnerable to Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)GHSA-56p2-6jwm-mvfc Published Yesterday

Medium Risk

This Affects:

mediawiki/maps

0.0.1 - 12.1.8

Fixed in 12.1.9

13.0.0 - 13.1.1

Fixed in 13.1.2

14.0.0 - 14.2.0

Fixed in 14.2.1

Are you affected? Scan for Free

TL;DR

MediaWiki Maps fetches GeoJSON source URLs that editors supply, guarded by UrlSsrfGuard, which blocks requests only against a reserved address denylist checked once through Wikimedia\IPUtils::isPublic(). That denylist misses IPv4-mapped, NAT64, and 6to4 encodings of reserved IPv4 addresses, and a second DNS resolution at fetch time can return a different address than the one already checked, a DNS rebinding race. Both gaps let an editor supplied GeoJSON URL reach internal or cloud metadata addresses despite the guard. The fix rewrites the guard to validate scheme and hostname syntax, block every reserved address encoding, fail closed on unresolved or mixed DNS answers, and pin the connection to the checked addresses so a later DNS lookup cannot substitute a different one.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you allow editors to provide external GeoJSON source URLs for maps.