CVE-2024-47841

CVE-2024-47841 is a path traversal flaw (CWE-22) in the Wikimedia Foundation's CSS extension for MediaWiki, in which pathname input used by the extension's CSS-loading functionality is not properly restricted to the intended directory. An unauthenticated network attacker can supply crafted path components (e.g., ../ sequences) to make the extension reach and load files outside the allowed directory. Per the CVSS 4.0 score of 6.9, the impact is limited: low confidentiality (unintended local file disclosure) and low integrity (unintended content loaded as CSS), with no availability impact and no effect beyond the vulnerable component. Only MediaWiki deployments with the CSS extension installed on the 1.39.x, 1.41.x, or 1.42.x branches at the listed versions are affected. No confirmed in-the-wild exploitation is reported (not in CISA KEV), but a public PoC reference exists (Phabricator T369486) and the 34.6% EPSS score (98th percentile) signals a materially elevated probability of near-term exploitation.

What to do: Sites running the CSS extension on MediaWiki 1.39.x, 1.41.x, or 1.42.x should upgrade to 1.39.9, 1.41.3, or 1.42.2 respectively (or later). If patching must be delayed, disable the CSS extension or restrict which users/requests can invoke it, and review access logs for path traversal patterns in CSS-related requests. The public PoC referenced in Phabricator task T369486 can be used to verify the fix.