The Wikimedia MediaWiki CSS extension is vulnerable to a path traversal flaw that permits unauthenticated attackers to access sensitive system files.

The vulnerability is a path traversal flaw (CWE-22) residing within the CSS extension, which fails to properly validate user-supplied input when accessing file paths. This allows an unauthenticated, remote attacker to bypass directory restrictions and read arbitrary files on the underlying host system.

Successful exploitation of this vulnerability can lead to the unauthorized disclosure of sensitive server configuration files, source code, or internal data. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to confidentiality, potentially facilitating further attacks or compromising the integrity of the entire MediaWiki instance.

Immediate Action: Monitor official Wikimedia security advisories and the Phabricator tracking ticket T401526 for the release of security patches and apply them immediately upon availability.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences, such as dot-dot-slash strings, directed toward the CSS extension endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and suspicious URL encoding attempts targeting the MediaWiki environment.

Public Exploit Available: exploit_available (false)

This vulnerability represents a significant risk due to the lack of required authentication for exploitation. Administrators should prioritize tracking the referenced Wikimedia Gerrit repository for the official fix and ensure that all affected MediaWiki installations are updated as soon as the vendor releases a patched version.