Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.39.16, 1.43.x prior to 1.43.6, 1.44.x prior to 1.44.3 or 1.45.x prior to 1.45.1. It is, therefore, affected by a number of vulnerabilities as follows.

- The xslt option is enabled by default in API format=xml responses. (CVE-2025-67484)

- Failure to escape the word-separator message in Special:ApiSandbox. (CVE-2025-67477)

- Failure to escape square brackets in autocomment links. (CVE-2025-67475)

- The importer's IP is used in case of an external revision author, leading to information disclosure. (CVE-2025-67476)

- Failure to always escape commas in mail encoded-words. (CVE-2025-67478)

- The Sanitizer does not disallow underscore and wide underscore in data-* attribute names. (CVE-2025-67479)

- Missing read permission check in ApiQueryRevisionsBase enabling an access control bypass. (CVE-2025-67480)

- Failure to escape the 'comma-separator' between multiple protection levels. (CVE-2025-67483)

- The 'style' attribute is allowed in client-side messages (jqueryMsg), enabling XSS. (CVE-2025-67481)

- A Lua segfault in unpack() leading to a denial of service. (CVE-2025-67482)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files     includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3,     1.45.1. (CVE-2025-67476)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115331	MediaWiki 1.45.x < 1.45.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115330	MediaWiki 1.44.x < 1.44.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115329	MediaWiki 1.43.x < 1.43.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
115328	MediaWiki < 1.39.16 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
278507	Linux Distros Unpatched Vulnerability : CVE-2025-67476	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-67476

medium

Tenable Plugins

medium

medium

medium

medium

medium