Skip to content
OpenAdvisories
Medium WID-SEC-2025-2825 10 CVEs

MediaWiki: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Published Dec 10, 2025 · Updated Feb 3, 2026 · Revision 4 · de-DE

Vendor: Debian Product: Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 10

  • Low 1.7
    CVE-2025-67482

    Lua segfault in unpack()

    Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3,…

    Wikimedia Foundation Scribunto luasandbox mediawiki Debian Ubuntu
  • Low 1.3
    CVE-2025-67476

    Importing leaks IP address of importer via EventStreams

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

    Wikimedia Foundation MediaWiki mediawiki Web / CMS Ubuntu
  • None 0.0
    CVE-2025-67475

    Stored XSS through edit summaries in MW Core

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects Me…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-67477

    Stored XSS through a system message in Special:ApiSandbox

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. Th…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-67478

    Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"

    Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.

    Wikimedia Foundation CheckUser mediawiki mediawiki Debian Ubuntu
  • None 0.0
    CVE-2025-67479

    Magic word replacement in legacy parser allows using reserved data attributes through wikitext

    Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4…

    Wikimedia Foundation MediaWiki Cite mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-67480

    list=allrevisions can be used to bypass Extension:Lockdown

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-67481

    mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This iss…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-67483

    Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaW…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-67484

    Action API xslt option allows JavaScript execution by administrators who are not interface administrators

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu

Revision history

  1. #4

    Referenz(en) aufgenommen: EUVD-2025-206755, EUVD-2025-206760

  2. #3

    Neue Updates von Debian aufgenommen

  3. #2

    Neue Updates von Debian aufgenommen

  4. #1

    Initiale Fassung

References