CVE-2025-61641 in MediaWiki
Summary
by MITRE • 02/03/2026
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php.
This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/25/2026
The vulnerability identified as CVE-2025-61641 represents a critical security flaw within the Wikimedia Foundation MediaWiki platform that specifically targets the api/ApiQueryAllPages.php program file. This issue manifests as a remote code execution vulnerability that could potentially allow attackers to execute arbitrary code on affected systems. The vulnerability stems from insufficient input validation and sanitization within the MediaWiki API endpoint responsible for querying all pages, making it susceptible to malicious payload injection attacks. Security researchers have identified that this flaw exists across multiple versions of the MediaWiki platform, with affected versions including those prior to 1.39.14, 1.43.4, and 1.44.1, indicating a widespread impact across different release branches of the software.
The technical nature of this vulnerability aligns with CWE-77 and CWE-94 categories, which respectively address command injection and code injection flaws within software applications. The flaw operates by allowing attackers to manipulate API parameters that are not properly sanitized before being processed by the MediaWiki backend system. When an attacker submits malicious input through the ApiQueryAllPages.php endpoint, the system fails to adequately validate or escape the input data, creating an opportunity for code injection attacks. This vulnerability could be exploited through various attack vectors including crafted API requests that leverage the query parameter handling mechanisms within the affected MediaWiki versions.
The operational impact of CVE-2025-61641 extends beyond simple data compromise, as it represents a significant threat to system integrity and availability. Organizations running affected MediaWiki installations face potential risks including unauthorized access to system resources, data exfiltration, and possible complete system takeover. The vulnerability could be particularly dangerous in environments where MediaWiki serves as a central content management platform for sensitive information or where multiple users have access to the API endpoints. Attackers could leverage this flaw to escalate privileges, install backdoors, or perform other malicious activities that would compromise the entire MediaWiki infrastructure and potentially affect connected systems.
Mitigation strategies for this vulnerability require immediate action from system administrators and security teams. The most effective approach involves upgrading to patched versions of MediaWiki, specifically versions 1.39.14, 1.43.4, or 1.44.1, depending on the current installation branch. Organizations should implement network-level restrictions to limit access to API endpoints, particularly when the API is exposed to untrusted networks. Additional protective measures include implementing web application firewalls, monitoring API access logs for suspicious activity, and conducting thorough security assessments of all MediaWiki installations. The ATT&CK framework categorizes this type of vulnerability under T1059.001 for command and scripting interpreter execution, making it essential for security teams to monitor for indicators of compromise related to API-based code execution attempts. Regular patch management processes should be enhanced to ensure prompt deployment of security updates and maintain compliance with industry standards for vulnerability remediation.