CVE-2026-58521 — SQL injection in Cargo extension via year range filter

An SQL injection vulnerability was identified in the MediaWiki Cargo Extension in connection with the year range filter.