Wikimedia MediaWiki/Cite up to 1.39.13/1.43.3/1.44.0 CoreParserFunctions.Php Remote Code Execution

Summaryinfo

A vulnerability labeled as problematic has been found in Wikimedia MediaWiki and Cite up to 1.39.13/1.43.3/1.44.0. This vulnerability affects unknown code of the file includes/Parser/CoreParserFunctions.Php. Such manipulation leads to an unknown weakness. This vulnerability is listed as CVE-2025-67479. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Wikimedia MediaWiki and Cite up to 1.39.13/1.43.3/1.44.0. It has been rated as problematic. Affected by this issue is an unknown part of the file includes/Parser/CoreParserFunctions.Php. The impact remains unknown. CVE summarizes:

Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Cite: from * before 1.39.14, 1.43.4, 1.44.1.

The advisory is shared for download at phabricator.wikimedia.org. This vulnerability is handled as CVE-2025-67479 since 12/08/2025. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

By approaching the search of inurl:includes/Parser/CoreParserFunctions.Php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.39.14, 1.43.4 or 1.44.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Vendor

• Wikimedia

Name

• Cite
• MediaWiki

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.39.0
• 1.39.1
• 1.39.2
• 1.39.3
• 1.39.4
• 1.39.5
• 1.39.6
• 1.39.7
• 1.39.8
• 1.39.9
• 1.39.10
• 1.39.11
• 1.39.12
• 1.39.13
• 1.40
• 1.41
• 1.42
• 1.43
• 1.43.0
• 1.43.1
• 1.43.2
• 1.43.3
• 1.44.0

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion