CVE-2020-26121: 
NixOS vulnerability analysis and mitigation

CVE-2020-26121 is a security vulnerability in MediaWiki that allows an attacker to import a file even when the target page is protected against page creation. This vulnerability was discovered and disclosed in September 2020 and affects MediaWiki installations prior to version 1.35.0 (Fedora Update).

The vulnerability is related to wfMessage and Html::rawElement functionality, as demonstrated through CosmosSocialProfile::getUserGroups. The issue allows attackers to bypass page creation protection mechanisms when importing files (CVE Mitre).

The vulnerability allows attackers to bypass security controls by importing files to protected pages that should be restricted against page creation. This could potentially lead to unauthorized content being added to protected areas of a MediaWiki installation (Fedora Update).

The vulnerability requires an attacker to have file import capabilities on the MediaWiki installation. While specific exploit code is not publicly available, the attack vector involves manipulating the file import functionality to bypass page protection mechanisms (CVE Mitre).

The vulnerability has been patched in MediaWiki version 1.35.0 and later releases. Users are advised to upgrade to the latest version of MediaWiki to protect against this vulnerability. The 1.35.x series is designated as a Long Term Support (LTS) release (Fedora Update).