shinthink/CVE-2026-58025

GitHubRepository PoCScanner

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script (exploit.py) and documentation (README.md) for CVE-2026-58025. The script generates a malicious XML payload, fingerprints MediaWiki instances for vulnerable versions, and attempts to upload the payload via Special:Import. It does not contain or execute a PHP gadget chain for remote code execution; the serialized payloads are limited to stdClass objects for detection. The primary operation is vulnerability detection and validation, not exploitation.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README.md documentation file and an exploit.py script that generates a malicious XML import file and optionally uploads it to a target MediaWiki instance. The script's behavior is consistent with a proof-of-concept for CVE-2026-58025: it constructs an XML payload containing serialized PHP objects in log entry parameters, fingerprints a target, and attempts to import the payload via Special:Import. No concealed backdoor, credential exfiltration, persistence mechanism, or unrelated payload delivery was observed. The script requires explicit user-supplied target and session cookies and does not perform any hidden harmful actions.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPythonMarkdown
Target softwareMediaWiki
Attack typesDeserialization of untrusted dataRemote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary function is to generate a detection payload and check if a target is vulnerable, not to achieve remote code execution. The serialized payloads are limited to stdClass objects for probing; the 'gadget' payload is explicitly a placeholder. The README states the script 'can also fingerprint MediaWiki instances and attempt the import via the API', and the code includes a --check flag for fingerprint-only mode. No functional gadget chain is provided, and the script does not execute arbitrary code on the target.

README.md:192-193exploit.py:80-85exploit.py:338exploit.py:356-360

Requirements

  • Target must be a MediaWiki instance with Special:Import accessible.exploit.py:178-179
  • Attacker must have import or importupload rights (default: sysop group) and valid session cookies.README.md:26exploit.py:390-392

Observed behavior

  • Generates a MediaWiki XML export file containing a logitem with serialized PHP objects in the <params> field.exploit.py:88-118
  • Fingerprints a target URL by checking for MediaWiki generator meta tag and version, and determines if the version is vulnerable.exploit.py:121-208
  • Attempts to upload the generated XML payload to Special:Import using provided session cookies.exploit.py:211-292
  • Performs bulk fingerprinting of multiple targets from a file.exploit.py:295-330
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
https://github.com/shinthink/CVE-2026-58025.gitRepository clone URL provided in README.md installation instructions.README.md:210
Command
python exploit.py --generate --output payload.xmlCommand to generate a malicious XML payload file.README.md:196
Command
python exploit.py -u https://target.com -c "session_cookies_here"Command to run the exploit against a target with session cookies.README.md:202
Network Activity
POST to /wiki/Special:Import with multipart form data containing malicious XMLThe exploit script uploads a crafted XML file to the target's import endpoint.exploit.py:243-260
Payload
Serialized PHP object in XML <params> field: a:1:{s:3:"foo";O:8:"stdClass":0:{}}The generated XML contains a serialized stdClass object to test deserialization behavior.exploit.py:80
Review boundaries

What the analysis did not establish

  • Two files (total 4) are omitted from the packet due to text budget; their content is unknown.
  • The artifact does not include a functional PHP gadget chain for RCE; the 'gadget' payload is a placeholder.
  • Two additional files in the repository (total 4 files) were not included in the text evidence; their content is unknown.
  • The review is limited to static analysis of the provided source code; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1