CVE-2025-61634 in MediaWiki
Summary
by MITRE • 02/03/2026
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php.
This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/17/2026
CVE-2025-61634 represents a critical vulnerability within the Wikimedia Foundation MediaWiki platform that specifically targets the includes/Rest/Handler/PageHTMLHandler.php component. This vulnerability arises from insufficient input validation and sanitization within the REST API handler responsible for processing HTML content in wiki pages. The flaw allows malicious actors to potentially inject arbitrary code or manipulate page rendering through crafted API requests that bypass normal security controls. The vulnerability affects multiple MediaWiki release lines including versions prior to 1.39.14, 1.43.4, and 1.44.1, indicating a widespread impact across different maintenance branches of the software. This issue falls under the category of code injection vulnerabilities and can be classified as CWE-94, which represents "Improper Control of Generation of Code ('Code Injection')" within the CWE top 25 list of most dangerous software weaknesses.
The technical exploitation of this vulnerability occurs when the PageHTMLHandler.php component processes user-supplied content without adequate sanitization of HTML elements or script tags. Attackers can craft malicious requests that include JavaScript or other executable code within the HTML content, which gets processed and rendered without proper escaping or validation. This creates a potential vector for cross-site scripting attacks, remote code execution, or unauthorized content manipulation within wiki environments. The vulnerability is particularly concerning in collaborative environments where multiple users can contribute content, as it allows for persistent malicious code injection that could affect all users accessing the compromised pages. From an operational perspective, this vulnerability directly impacts the integrity and availability of wiki content, potentially enabling attackers to deface websites, steal user sessions, or establish persistent backdoors within the MediaWiki infrastructure.
The impact of CVE-2025-61634 extends beyond simple code injection as it represents a fundamental breakdown in the application's security controls for handling user-generated content through the REST API interface. Organizations running MediaWiki instances are at risk of having their wikis compromised, leading to potential data breaches, service disruption, and reputational damage. The vulnerability's presence across multiple release lines indicates that organizations must urgently assess their current MediaWiki versions and implement immediate patches or mitigations. Security teams should monitor for suspicious API activity and content modifications that could indicate exploitation attempts. The ATT&CK framework categorizes this vulnerability under T1059.007 for "Command and Scripting Interpreter: JavaScript" and potentially T1566 for "Phishing" if attackers use the vulnerability to deliver malicious payloads through compromised wiki pages. Organizations should prioritize updating to the patched versions and implement additional monitoring controls around API endpoints that handle HTML content to detect and prevent exploitation attempts.
Organizations affected by this vulnerability should immediately implement the security patches provided by Wikimedia Foundation for versions 1.39.14, 1.43.4, and 1.44.1, depending on their current MediaWiki installation. Additionally, implementing proper input validation and sanitization measures for all user-generated content through the REST API interface can serve as a temporary mitigation while full patches are deployed. Network monitoring should be enhanced to detect anomalous API requests that might indicate exploitation attempts, particularly those involving HTML content manipulation. Regular security audits of MediaWiki installations should include verification of proper sanitization controls in REST API handlers, and access controls should be reviewed to limit who can submit HTML content through the API. The vulnerability highlights the importance of maintaining up-to-date software versions and implementing robust security practices for collaborative content management systems.